## 3 Review of Four-Dimensional GLV-GLS Scalar Multiplication  
The curve Ted127-glv4 was introduced by [PERSON] and [PERSON] [14]. It is based on twisted Edwards curves and has efficiently computable endomorphisms, which facilitates the four-dimensional GLV-GLS scalar multiplication. The parameters of curve Ted127-glv4 are as follows:  
\[E/\mathbb{F}_{p^{2}}:-x^{2}+y^{2}=1+dx^{2}y^{2},\]  
where \(d=170141183460469231731687303715884099728+1168290868471658102218729755422410377 73i\), \(p=2^{127}-5997\) and \(\#E(\mathbb{F}_{p^{2}})=8r\), where \(r\) is a 251-bit prime. Let \(\mathbb{F}_{p^{2}}=\mathbb{F}_{p}[i]/(i^{2}+1)\) and \(u=1+i\) be a quadratic non-residue in \(\mathbb{F}_{p^{2}}\). \(E\) is isomorphic to the Weierstrass curve \(E^{\prime}/\mathbb{F}_{p^{2}}:y^{2}=x^{3}-15/2u^{2}x-7u^{3}\). The curve Ted127-glv4 contains two efficiently computable endomorphisms \(\phi\) and \(\psi\) defined over \(\mathbb{F}_{p^{2}}\) as follows:  
\[\phi(x,y)= \bigg{(}-\frac{(\zeta_{8}^{3}+2\zeta_{8}^{2}+\zeta_{8})xy^{2}+( \zeta_{8}^{3}-2\zeta_{8}^{2}+\zeta_{8})x}{2y},\frac{(\zeta_{8}^{2}-1)y^{2}+2 \zeta_{8}^{3}-\zeta_{8}^{2}+1}{(2\zeta_{8}^{3}+\zeta_{8}^{2}-1)y^{2}-\zeta_{8 }^{2}+1}\bigg{)},\] \[\psi(x,y)=\left(\zeta_{8}x^{p},\frac{1}{y^{p}}\right),\]  
where \(\zeta_{8}=u/\sqrt{2}\) is a primitive eighth root of unity. It can be verified that \(\phi^{2}+2=0\) and \(\psi^{2}+1=0\).  
Let \(P\) be a point in \(E/\mathbb{F}_{p^{2}}\) and \(k\) be a random scalar in the range \([1,r]\). Algorithm 1 outlines variable-base scalar multiplication using curve Ted127-glv4 and four-dimensional decompositions. Steps 1 and 2 in Algorithm 1 compute three endomorphisms \(\phi(P),\psi(P)\), and \(\psi(\phi(P))\), and then compute the eight points \(T[u]=P+u_{0}\phi(P)+u_{1}\psi(P)+u_{2}\psi(\phi(P))\), where \(u=(u_{2},u_{1},u_{0})\) in \(0\leq u\leq 7\). Step 3 decomposes the input scalar \(k\) into multi-scalars \((k_{0},k_{1},k_{2},k_{3})\) such that \(0\leq k_{i}\leq 2^{65}\), where \(0\leq i\leq 3\). For constant-time implementation, the multi-scalars \((k_{0},k_{1},k_{2},k_{3})\) must guarantee the same number of iterations of the main computation. Because all coordinates of scalar decomposition are less than \(2^{65}\), we apply the scalar recoding algorithm to guarantee a fixed loop length for the main computation at step 4 [25]. The result of the scalar recoding is represented by 66 lookup table indices \(d_{i}\) and 66 masks \(m_{i}\), where \(0\leq i\leq 65\). Steps 5 to 9 represent the main computation stage, including point loading, the ECADD operation, and the ECDBL operation. The result of the main computation is converted from an extensible coordinates to the affine coordinates in step 10. Therefore, a variable-base scalar multiplication using curve Ted127-glv4 requires one \(\phi(P)\) endomorphism, two \(\psi(P)\) endomorphisms, and seven ECADD operations in the precomputation; 65 table lookups, 65 ECADD operations, and 65 ECDBL operations in the main computation; and one inversion and two field multiplications over \(\mathbb{F}_{p^{2}}\) for point normalization.  
Figure 1 describes the implementation hierarchy of four-dimensional GLV-GLS scalar multiplication and its internal algorithms. Because the implementation algorithms at each level affect the performance of scalar multiplication, we carefully choose proper algorithms considering the features of AVR, MSP430, and ARM processors. Additionally, field arithmetic over \(\mathbb{F}_{p^{2}}\) and curve arithmetic are comprised of field arithmetic over \(\mathbb{F}_{p}\), which is the computationally primary operations. Therefore, field arithmetic over \(\mathbb{F}_{p}\) is written at the assembly level.