On the Linear Complexity of the Naor-Reingold Pseudo-Random Function