K. Nath and P. Sarkar, “Reduction Modulo 2^{448}-2^{224}-1”, mathcryptology, no. 1, pp. 8–21, Jan. 2021.