Yes, it's in Section 15.8 of the 2nd edition of Applied Cryptography. This is basically that scheme, but we're not inflating ciphertexts as he suggests (which is a good thing).