## 6 Performance Analysis and Implementation Results
### Implementation Results of Scalar Multiplication  
Table 4 summarizes the implementation results of variable-base scalar multiplication compared to the previous implementations on the 8-bit AVR, 16-bit MSP430, and 32-bit ARM processors. We measured the average cycles for our variable-base scalar multiplication by running it \(10^{3}\) times with random scalars \(k\). For comparison, Table 4 includes the previous implementations that guarantee constant-time execution. These were implemented using various elliptic curves, such as NIST P-256 [42; 43], Curve25519 [44; 45; 46], \(\mu\)Kummer [47], and Four\(\mathbb{Q}\)[24]. These curves are designed such that the bit-length of the curve order is slightly smaller than 256-bit for efficient implementation. NIST P-256 has a 256-bit curve order, but Curve25519, \(\mu\)Kummer, Four\(\mathbb{Q}\), and curve Ted127-glv4 have 252-bit, 250-bit, 246-bit, and 251-bit curve orders, respectively. Therefore, these curves provide approximately 128-bit security levels. We will now summarize the implementation results of previous works on embedded devices that provide approximately 128-bit security levels. [PERSON] and [PERSON] [42] and [PERSON] et al. [43] implemented the scalar multiplication using the NIST P-256 curve on various 16-bit microcontrollers and 8-bit, 16-bit, and 32-bit microcontrollers. [PERSON] and [PERSON] [48] implemented the NaCl library on 8-bit AVR processor, which provides a Curve25519 scalar multiplication. [PERSON] et al. [44] implemented a Diffie-Hellman key exchange on MSP430X processor using 16-bit and 32-bit hardware multipliers. In 2015, [PERSON] et al. [45] implemented a Curve25519 scalar multiplication of on 8-bit, 16-bit, and 32-bit microcontrollers. [PERSON] et al. [47] implemented a Montgomery ladder scalar multiplication on the Kummer surface of a genus 2 hyperelliptic curve on 8-bit AVR and 32-bit ARM Cortex-M0 processors. [PERSON] et al. [25] proposed an efficient implementation of the four-dimensional GLV-GLS scalar multiplication using curve Ted127-glv4 on Intel and ARM processors. \begin{table}
\begin{tabular}{c l c c c c} \hline \hline
**Platform** & **Implementations** & \begin{tabular}{c} **Bit-Length of** \\ **Curve Order** \\ \end{tabular} & \begin{tabular}{c} **Cost** \\ **(Cycles)** \\ \end{tabular} & \
\begin{tabular}{c} **Code Size** \\ **(Bytes)** \\ \end{tabular} &
\begin{tabular}{c} **Stack Usage** \\ **(Bytes)** \\ \end{tabular} \\ \hline \multirow{8}{*}{AVR} & NIST P-256 [43] & 256 & 34,930,000 & 16,112 & 590 a  \\  & Curve25519 [48] & 252 & 22,791,579 & n/a & 677 \\  & Curve25519 [45] & 252 & 13,900,397 & 17,710 & 494 \\  & \(\mu\)Kummer [47] & 250 & 9,513,536 & 9490 & 99 \\  & Four\(\mathbb{Q}\)[24] & 246 & 6,561,500 & n/a & n/a \\  & Ted127-glv4 (This work) & 251 & 6,856,026 & 13,891 & 2539 \\ \hline \multirow{8}{*}{MSP430} & NIST P-256 [42] & 256 & 23,973,000 & n/a & n/a \\  & NIST P-256 [43] & 256 & 22,170,000 & 8378 & 418 a  \\  & Curve25519 [44] & 252 & 9,139,739 & 11,778 & 513 \\  & Curve25519 [45] & 252 & 7,933,296 & 13,112 & 384 \\  & Four\(\mathbb{Q}\)[24] & 246 & 4,280,400 & n/a & n/a \\  & Ted127-glv4 (This work) & 251 & 4,158,453 & 9098 & 2568 \\ \hline \multirow{2}{*}{ARM Cortex-M4} & Curve25519 [46] & 252 & 1,423,667 & 3750 & 740 \\  & Four\(\mathbb{Q}\)[24] & 246 & 469,500 & n/a & n/a \\ \cline{1-1}  & Ted127-glv4 (This work) & 251 & 447,836 & 7532 & 2792 \\ \hline \end{tabular}
\end{table} 
Table 4: Cycle counts and memory usage of variable-base scalar multiplication on 8-bit AVR, 16-bit MSP430, 32-bit ARM processors. The implementation results of variable-base scalar multiplication set new speed records on the 16-bit MSP430 and 32-bit ARM Cortex-M4 processors. Scalar multiplication using curve Ted127-glv4 on AVR, MSP430, and ARM requires 6,856,026, 4,158,453, and 447,836 cycles, respectively.