## 5 Application to GCM Mode's GHASH Function Implementation  
We have applied the proposed \(BF\) multiplication method to the GHASH function of GCM as a case study. Since the GHASH function of GCM requires several 128-bit \(BF\) multiplications, the \(BF\) needs to be implemented in a secure and efficient way. Even though [PERSON] et al. proposed an efficient and secure \(BF\) multiplication method for secure GHASH function of GCM of operation [10], the performance of their method needs to be improved for efficient GHASH function. Our method is more efficient than \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Bit** & **Method** & **Timing (\(cc\))** & **Improvement** & **Language** \\ \hline
64-bit & [PERSON] et al.’s Karatsuba Block-Comb (Level 1) & 1330 & - & ASM \\
128-bit & [PERSON] et al.’s Karatsuba Block-Comb (Level 2) & 5675 & - & ASM+C \\ \hline
64-bit & Proposed Block-Comb with ME & 1213 & 8.8\% & ASM \\
64-bit & Proposed Block-Comb without ME & 1050 & 21.1\% & ASM \\
128-bit & Proposed Karatsuba Block-Comb (Level 1) with ME & 3816 & 32.8\% & ASM \\
128-bit & Proposed Karatsuba Block-Comb (Level 1) without ME & 3490 & 38.5\% & ASM \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Timing analysis and comparison for the proposed SCA-resistant 64-bit, and 128-bit wise \(BF\) multiplication (the cost includes the overhead for function calls, such as POP and PUSH instructions). ME means multiplier encoding. Figure 4: Comparison of power consumption patterns between the False case and the True case when using a single garbage register. [PERSON] et at. 's method by 38.5% while providing TA and SPA security. We also apply our method to the GHASH function and suggest some optimization methods specific to GCM. Since the hash key \(H\) is fixed in the GHASH function, it can be encoded at the beginning of the GHASH function, and the encoded \(H\) can be used for \(BF\) multiplications in the GHASH function without encoding \(H\) every time. Thus, we can save the overhead for encoding the multiplier of the \(BF\) multiplications in the GHASH function. In GCM standard, the bits in the state are reflected. In other words, the leftmost bit is considered as the 0-th bit and the rightmost bit is considered as the 127-th bit, while general crypto algorithms typically utilize the opposite notation. Therefore, two inputs of \(BF\) multiplication need to be bit-reflected and the output is also required to be bit-reflected. We apply a table-based bit-reflection method (it requires 256-byte table). However, compared with [PERSON] et al. 's method using three bit-reflections for two inputs and an output, our implementation requires only one bit-reflection. Figure 5 describes the process of GHASH function of GCM. The inputs of \(BF\) multiplication (each of \((A_{1},\ldots,A_{m},C_{1},\ldots,C_{n})\) and \(H\)) and the output \((V_{1},\ldots,V_{m+n})\) need to be bit-reflected. Our implementation encodes the hash key \(H\) at the beginning of the GHASH function and stores it in bit-reflected form, which removes the need for bit-reflection of \(H\) at each \(BF\) multiplication. Our implementation combines the bit-reflection of \(BF\) multiplication output and the bit-reflection of one input \((A_{1},\ldots,A_{m},C_{1},\ldots,C_{n})\). Since the output of previous \(BF\) multiplication is XORed with the one input of the next \(BF\) multiplication, we can combine two bit-reflection into one. In other words, \(BitReflect(O)\ XOR\ BitReflect(I)=BitReflect(I\ XOR\ O)\) where \(BitReflect\) is a bit-reflection function and, \(O\) is the output of the previous \(BF\) multiplication, and \(I\) is the input of the next \(BF\) multiplication. Thus, in our implementation, only one bit-reflection is required at each \(BF\) multiplication, which can improve GHASH function's performance further. We have measured the performance of the proposed GHASH implementation on an 8-bit ATmega128 MCU for each of 16 byte, 64 byte, and 256 byte messages and compare the results with those of [PERSON] et al. 's work. Even though [PERSON] et al.