## 1 Introduction  
Binary field (\(BF\)) multiplication is an important and the most time-consuming arithmetic operation in several widely used cryptographic algorithms, including the Galois/Counter mode (GCM) operation and NIST-compliant binary ECC (Elliptic Curve Cryptosystems). For example, the central computation part of the GHASH function in GCM is consecutive 128-bit \(BF\) multiplications, and \(BF\) multiplications also occupy almost 80% of the running time of binary Elliptic Curve Cryptosystems, such as ECDH (Elliptic Curve Diffie-Hellman), ECDSA (Elliptic Curve Digital Signature Algorithm), ECIES (EllipticCurve Integrated Encryption Scheme), and ECMQV (Elliptic Curve Menezes-Qu-Vanstone) (ECDH and ECMQV are key agreement schemes based on Diffie-Hellman and MQV, respectively. ECIES is known as the Elliptic Curve Augmented Encryption Scheme, which can be used as a key transport mechanism. ECDSA is a digital signature algorithm based on the Digital Signature Algorithm. Details of the aforementioned Elliptic Curve-based algorithms can be found in [1]). However, the representatives of 8 bit, 16 bit, and 32 bit embedded microcontrollers, including AVR, MSP430, and ARM Cortex-M, do not have a dedicated multiplier for the binary field multiplication. For this reason, the software implementation of the multiplication over a binary field has been considered to be a more challenging task than that of the multiplication over a prime field. Furthermore, 8-bit AVR and 16-bit MSP430 MCUs are very resource-limited regarding memory and computation capacity. Thus, designing an optimal \(BF\) multiplication method on such MCUs is a challenging task. Nonetheless, until now, several efficient \(BF\) multiplication methods have been proposed on 8-bit AVR MCUs and they are classified into two main categories: Lookup Table (LUT)-based approaches [2; 3; 4; 5] and Block-Comb (\(BC\))-based approaches [6; 7; 8; 9; 10]. Among several optimization techniques [2; 3; 4; 5; 6; 7; 8; 9], the Karatsuba Block-Comb (\(KBC\)) multiplication method was shown that it could provide better performance compared with the LUT-based approach [2; 3; 4; 5] when calculating a multiplication over \(GF(2^{163})\). From the works in [6; 7; 8], the maximum block size is widely known as seven words on 8-bit AVR microcontrollers. However, recently [PERSON] et al. have proposed an enhanced Karatsuba Block-Comb multiplication technique and shown how to extend the block size from seven to eight with their novel multiplier encoding technique [9]. By expanding the block size, they could decrease the number of partial products required to calculate a multiplication over \(GF(2^{233})\) in the context of a NIST-compliant Binary K-233 Curve. Even though [PERSON] et al. 's multiplication method over a binary field provides the best performance among existing \(BF\) multiplication methods, it does not provide resistance against Timing Analysis (TA) and Simple Power Analysis (SPA). There have been some works regarding the SCA (side channel analysis) security of \(BF\) multiplication [10; 11]. [PERSON] et al. showed that LUT-based multiplication methods are vulnerable to horizontal Correlation Power Analysis (CPA) [12] and proposed a masked Block-Comb multiplication method, which does not use any LUT while providing TA and SPA resistance by eliminating a conditional loop in its execution [11]. Their method is used for the GCM mode of operation and it computes a 128-bit \(BF\) multiplication in 14,445 \(cc\). Most recently, [PERSON] et al. have shown that the masked Block-Comb multiplication method from [PERSON] et al. actually does not provide SPA security and proposed a novel secure Block-Comb (\(SBC\)) multiplication method with a new concept of Dummy XOR operations using a set of garbage registers and a concept of instruction level atomicity for both TA and SPA security [10]. [PERSON] et al. 's method can compute a multiplication over \(GF(2^{128})\) in 5675 \(cc\), and its TA and SPA security are proven to be secure. Although [PERSON] et al.