## 6 Performance Analysis and Implementation Results
### Implementation Results of Field Arithmetic
One can see that the field arithmetic over \(\mathbb{F}_{p}\) in Four\(\mathbb{Q}\) on AVR and MSP430 is typically faster than curve Ted127-glv4. This difference occurs because the primes of both curves are different, with a Mersenne prime of the form \(p=2^{127}-1\) in Four\(\mathbb{Q}\) and a Mersenne-like prime of the form \(p=2^{127}-5997\) in curve Ted127-glv4. Let \(p=2^{127}-\delta\), where \(\delta\) is small. The modular reduction step can be computed by \(c=c_{h}\cdot 2^{128}+c_{l}\equiv c_{l}+2\cdot\delta\cdot c_{h}\pmod{p}\). In this process, Four\(\mathbb{Q}\) can be efficiently computed using simple shift operations because \(\delta=1\), but the curve Ted127-glv4 requires more instructions because it uses multiplication by \(\delta=5997=0\)x176d. In the 8-bit AVR implementation, 0x176d can be represented by two 8-bit words as 0x17 and 0x6d. Therefore, the operation \(c_{l}+2\cdot\delta\cdot c_{h}\pmod{p}\) requires more 8 \(\times\) 8-bit multiplications and accumulations. Unlike the AVR implementation, 0x176d can be represented by one word in the MSP430 and ARM CPUs. Additionally, these CPUs provide efficient MAC instructions. Therefore, the modular reduction on MSP430 and ARM implementations require fewer additional instructions than the AVR implementation. In the case of the MSP430, field squaring over \(\mathbb{F}_{p}\) in curve Ted127-glv4 is faster than in Four\(\mathbb{Q}\). The field squaring over \(\mathbb{F}_{p}\) in curve Ted127-glv4 requires 837 cycles, whereas Four\(\mathbb{Q}\) requires 927 cycles. Our implementation saves 9.71% of the cycles for field squaring over \(\mathbb{F}_{p}\) compared to the SBD method, \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline \multirow{2}{*}{**Operation**} & \multicolumn{2}{c}{**8-Bit AVR**} & \multicolumn{2}{c}{**16-Bit MSP430**} & \multicolumn{2}{c}{**32-Bit ARM**} \\ \cline{2-7}  & \multicolumn{2}{c}{**Ted127-glv4**} & \multirow{2}{*}{**Four\(\mathbb{Q}\)[24]**} & \multicolumn{2}{c}{**Ted127-glv4**} & \multirow{2}{*}{**Four\(\mathbb{Q}\)[24]**} & \multicolumn{2}{c}{**Ted127-glv4**} \\  & & **(This Work)** & & & **(This Work)** & & **(This Work)** & **Four\(\mathbb{Q}\)[24]** \\ \hline \multirow{6}{*}{\(\mathbb{F}_{p}\)} & Add & 198 & 155 & 120 & 102 & 55 & n/a \\  & Sub & 196 & 159 & 126 & 101 & 55 & n/a \\  & Sqr & 1221 & 1026 & 837 & 927 & 88 & n/a \\  & Mul & 1796 & 1598 & 1087 & 1027 & 99 & n/a \\  & Inv & 176,901 & 150,535 & 119,629 & 131,819 & 12,135 & n/a \\ \hline \multirow{6}{*}{\(\mathbb{F}_{p^{2}}\)} & Add & 452 & 384 & 266 & 233 & 82 & 84 \\  & Sub & 448 & 385 & 278 & 231 & 82 & 86 \\ \cline{1-1}  & Sqr & 4093 & 3622 & 2476 & 2391 & 195 & 215 \\ \cline{1-1}  & Mul & 6277 & 5758 & 3806 & 3624 & 341 & 358 \\ \cline{1-1}  & Inv & 183,345 & 156,171 & 123,740 & 135,315 & 12,612 & 21,056 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Cycle counts for field arithmetic on 8-bit AVR, 16-bit MSP430, and 32-bit ARM processors, including function call overhead. despite the modular reduction overhead. Additionally, the principal operation of inversion is field squaring over \(\mathbb{F}_{p}\), our implementation saves 9.32% and 8.55% of the cycles for inversion over \(\mathbb{F}_{p}\) and \(\mathbb{F}_{p^{2}}\). For field squaring over \(\mathbb{F}_{p^{2}}\), field squaring over \(\mathbb{F}_{p}\) is not required because it can be computed by \(2M_{1}+1A_{1}+2A_{i}\) operations. Therefore, field squaring over \(\mathbb{F}_{p^{2}}\) for Ted127-glv4 requires more cycles than Four\(\mathbb{Q}\).