^{1}

^{1}

^{1}

^{1}

^{2}

^{1}

^{*}

This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution license (http://creativecommons.org/licenses/by/3.0/).

Elliptic curve cryptography (ECC) is one of the most promising public-key techniques in terms of short key size and various crypto protocols. For this reason, many studies on the implementation of ECC on resource-constrained devices within a practical execution time have been conducted. To this end, we must focus on scalar multiplication, which is the most expensive operation in ECC. A number of studies have proposed pre-computation and advanced scalar multiplication using a non-adjacent form (NAF) representation, and more sophisticated approaches have employed a width-

Elliptic curve cryptography (ECC) is a public-key cryptography based on the algebraic structure of elliptic curves over finite fields [_{q}_{q}

In this paper, we propose an efficient method for fixed-point scalar multiplication, enhancing the method of Mohamed

We found zero occurrence characteristic of _{w}

We presented a finely-tuned hybrid model, which can adjust size and speed performance more accurately. This can establish a customized look-up table for embedded microprocessors, by adjusting the program size or computation costs.

We applied this method to an unknown point and show high performance enhancement by 12.7% compared to traditional _{w}

The paper is organized as follows. In Section 2, we give an introduction to existing scalar multiplication methods, including those mentioned above. In Section 3, we introduce our proposed method, and in Section 4 we evaluate our proposal. Finally, we conclude our paper in Section 5.

In this section, we explore scalar multiplication, which is one of the most expensive operations of elliptic curve cryptography. As shown in Algorithm 1, the inputs of the double-and-add algorithm are a random number, _{q}

Input:

_{t-1},…,

_{1}, k

_{0})2,

_{q}

_{i}

To describe scalar multiplication, we assume that #_{q}_{t–1}, …, _{2}, _{1}, _{0})_{2}, where _{2q}

If _{q}_{i}

The window method efficiently reduces the running time of scalar multiplication, using extra memory for pre-computation by window size. Thus, scalar multiplication time can be decreased by a window method that processes

To improve its performance, the window method can be combined with NAF in a technique known as width-w NAF. _{w}^{w}^{w}^{w-1}≤ ^{w-1}. The digits of _{w}^{w−1}, 2^{w−1}^{w}^{w−1}, ensuring that the next _{w}

Input: Window width

_{w}

_{i}

^{w},

_{i}

_{i}

_{i}

_{–1},

_{i}

_{–2}, …,

_{1},

_{0})

Input: Window width

_{q}

_{i}

^{w}

^{-1}− 1}. 3.

_{i}

_{i}

_{ki}

_{ki}

Let ^{R}_{i}_{i}_{i,j}_{i}_{i,v-1},…, _{i,1},
_{0}= _{i}^{R}

Let _{i}_{i,a-1},…, _{i,1}, _{i,0} be the binary representation of _{i}_{i,j}(0 ≤ _{i,j}_{i}_{jb+b−1},…, _{i,jb+k},… _{i}_{,j}_{b+}_{1},_{i}_{jb}

The following values are pre-computed and stored for all 1 ≤ ^{h}_{h−1},…, _{1}, _{0}.:
_{j,k}_{h-1,bj+k}, …, _{1,bj+k}, _{0,bj+k}(0 ≤ ^{R}

Input: Exponent

_{n}

^{R}

_{ki=}

_{h}g

^{mibi}

_{i}

^{mibi}

Let

From right-to-left, the

Let _{0}= _{j}^{hb}_{j−1}= 2^{jhb}_{jb+t}= _{h-1,jb+t},… _{1,jb+t}, _{0,jb+t} is the NAF representation.

Suppose that the following values described in expression (7) are pre-computed and stored for all
_{j,t}_{h-1,jb+t}, …, _{1,jb+t}, _{0jb+t}.

Using expression (7),

Input: Positive integers

_{q}

^{h}R

_{h-1,bj+k}

_{0},

_{bj+k}

_{NAF}

_{j,k}] 2.3.2 Else if (

_{h}

_{-1},

_{bj+k}

_{0},

_{bj+k}

_{NAF}

Input: A positive integer

^{r}

_{q}

^{r}P

_{1}=

_{1},.

_{1}= -y

_{1}. 2. For

_{2}

_{r}

_{2}

_{r}

Input: Positive integers

_{l-1}

_{1},

_{0}

_{NAFw}, P

_{q}

^{2}, 2

^{3},…, 2

^{w-1}},

^{w}

^{-1}− 1}. 3.

^{w}Q

_{j.t}

_{jb+t,w}

_{-1},…,

_{jb+t}

_{0})

_{NAFw}4.3.2 If

_{j,t}

_{j,t}

_{j,t}

_{j,t}

Sakai and Sakurai proposed a multi-doubling method for elliptic scalar multiplication. This reduced computational complexity by applying one constant inversion operation, regardless of the number of doubling. The complexity is given as (4r + 1)_{q}

This method represents the scalar, _{d}_{d,dw+i}_{d,dw+i}_{d,dw+i}_{d,i}_{jb+t}= _{jb+t,w−1}… _{jb+t,0} is in width-^{2}, 2^{3},…, 2^{w−1}},0 < ^{w−1}− 1}:
_{w−1}… _{1}_{0}). Therefore, _{j,t}_{jb+t},_{w−1}… _{jb+t,0}.

This method represents the scalar, _{d}_{d,dw+i}. For each element, _{d,dw+i}, the first subscript, _{d,dw+i} is written as _{d,i}_{tw2+i}= _{tw2+w(w−1),i}… _{tw2+w,i}_{tw2,i} is in width −^{2}, 2^{3}, …, 2^{w-1}} and ^{w},…, 2^{w(z−1)}}.
_{w2(}_{z−}_{1)}…_{w2}·_{w}_{w2} …_{w}_{0}). Therefore, _{i}_{,t}_{zw2+w(w-1)}_{,i}_{zw2,i}) _{NAFw}

Input: Positive integers

_{l_1}

_{1},

_{0})

_{NAF}

_{W}

_{q}

^{2}, 2

^{3},…, 2

^{w-1}},

^{0}, 2

^{w},…, 2

^{w(a-1)}}. 3.

_{i,t}

_{zw2+w}

_{(}

_{w}

_{-1)},

_{i}

_{zw}

_{NAFW}. 4.2.2 If

_{zw}

_{2+}

_{w}

_{(}

_{w}

_{-1)}> 0, then 4.2.2.1

_{i,t}

_{zw}

_{2+}

_{w}

_{(}

_{w}

_{-1)}< 0 4.2.3.1

_{i,t}]. 5. Return (

In this section, we demonstrate fixed-base scalar multiplication in a block form to allow a comparison of the table structures. In the example, we use a 64-bit scalar value, _{0}, _{16}, _{32}, _{48}), …, (_{15}, _{31}, _{47}, _{63}).

In the case of Tsaur and Chou's method described in _{0}, _{16}, _{32}, _{48}), …, (_{15}, _{31}, _{47}, _{63}). However, the scalar value (_{2}(

In the case of Mohamed, Hashim and Hutter's method described in _{0}, _{1}, _{2}, _{3}), …, (_{60}, _{61}, _{62}, _{63}). This structure is efficiently reducing table size, because within window size, only one element can have a value.

Our proposed method described in _{0}, _{4}), (_{2}, _{6}), (_{3}, _{7}) and (_{4}, _{8}), exhibit a strong interrelationship. If one value is set, the other has a high probability of being set, and the opposite case shows same results. In _{0}, _{4}, _{8}, _{12}), …, (_{51}, _{55}, _{59}, _{63}).

The size-optimized model has a pre-computation table combining the proposed method and that of Mohamed _{0}, _{1}, _{44}), (_{22}, _{23}, _{45}) …, (_{20}, _{21}, _{64}), (_{42}, _{43}, _{65}). To compute this structure, elements are added to a result, and then, the result is doubled twice.

In _{0}, _{1}, _{35}), (_{2}, _{33}, _{34}) …, (_{32}, _{63}, _{64}), (_{30}, _{31}, _{65}).

In _{0}, _{1}, _{4}, _{5}), (_{2}, _{3}, _{6}, _{7}) …, (_{56}, _{57}, _{60}, _{61}), (_{58}, _{59}, _{62}, _{63}).

In _{0}, _{1}, _{3}, _{35}), (_{3}, _{32}, _{33}, _{34}) …, (_{31}, _{60}, _{61}, _{62}), (_{28}, _{29}, _{30}, _{63}).

The hybrid method combines two methods, including our size-optimized or speed-optimized model and that of Mohamed

In _{0} to _{23}, 3NAF version 1 is used, and the remaining part follows Mohamed

In

In

In

In this section, we evaluate the proposed method in terms of its look-up table size and computation speed for practical performance evaluation.

Random numbers are needed to evaluate the methods of generating the secret value (

Our model is perfectly suited to the characteristics of

The following

In

In

In this section, we consider the size of the look-up tables, and detailed table size is described in ^{w} − 1) × ^{w-}^{1)} + 1, so the table size is ((2^{(w-1}) + 1)^{(w-1)}(2^{(w-2)} + 1)) × ^{(w-2)} × ^{(w-2)} × (2^{(w-1)} + 1) + 2^{(w-2)}) ×

However, in

In

Our hybrid model is developed during evaluation of the previous models to overcome the drawbacks of the proposed method.

Recently released novel scalar multiplication by Mohamed _{w}

“This work was supported by the Industrial Strategic Technology Development Program (No.10043907, Development of high performance IoT device and Open Platform with Intelligent Software) funded by the Ministry of Science, ICT & Future Planning (MSIF, Korea).”

In this section, we give a detailed process of proposed methods, including speed, size and hybrid models. _{0}, _{4}, _{8}, _{12}), (_{1}, _{5}, _{9}, _{13}), (_{2}, _{6}, _{10}, _{14}), (_{3}, _{7}, _{11}, _{15}), (_{16},_{20},_{24}, _{28}), (_{17},_{21},_{25},_{29}), (_{18}, _{22},_{26},_{30}), (_{19}, _{23}, _{27}, _{31}), (_{32},_{36},_{40},_{44}), (_{33},_{37},_{41}, _{45}), (_{34},_{38},_{42},_{46}), (_{35}, _{39},_{43},_{47}), (_{48}, _{52}, _{56}, _{60}), (_{49},_{53},_{57},_{61}), (_{50}, _{54}, _{58}, _{62}), (_{51}, _{55}, _{59}, _{63})]. Afterward, then, scalar multiplication is conducted in the following order. Firstly, elements, including (_{3}, _{7}, _{11}, _{15}), (_{19}, _{23}, _{27}, _{31}), (_{35}, _{39}, _{43}, _{47}) and (_{51}, _{55}, _{59}, _{63}), are added to a point, and then, doubling is conducted. Secondly, elements, including (_{2},_{6},_{10},_{14}), (_{18}, _{22}, _{26},_{30}), (_{34}, _{38}, _{42}, _{46}) and (_{50},_{54},_{58},_{62}), are added to the point, and then, doubling is conducted. Thirdly, elements, including (_{1}, _{5}, _{9}, _{13}), (_{17}, _{21}, _{25}, _{29}), (_{33}, _{37}, _{41}, _{45}) and (_{49}, _{53}, _{57}, _{61}), are added to the point, and then, doubling is conducted. Finally, elements, including (_{0}, _{4}, _{8}, _{12}), (_{16}, _{20}, _{24}, _{28}), (_{32}, _{36}, _{40}, _{44}) and (_{48}, _{52}, _{56}, _{60}), are added to the point.

For the size-optimized model in _{0}, _{1}, _{44}), (_{2}, _{3}, _{46}), (_{4}, _{5}, _{48}), (_{6}, _{7}, _{50}), (_{8}, _{9}, _{52}), (_{10},_{11},_{54}), (_{12},_{13},_{56}), (_{14},_{15},_{58}), (_{16},_{17},_{60}), (_{18},_{19},_{62}), (_{20},_{21},_{64}), (_{22},_{23},_{45}), (_{24},_{25},_{47}), (_{26},_{27},_{49}), (_{28},_{29},_{50}), (_{30},_{31},_{53}), (_{32},_{33},_{55}), (_{34}, _{35}, _{57}), (_{36}, _{37}, _{59}), (_{38}, _{39}, _{61}), (_{40}, _{41}, _{63}), (_{42}, _{43}, _{65})] Firstly, elements, including (_{2}, _{3}, _{46}), (_{6}, _{7}, _{50}), (_{10}, _{11}, _{54}), (_{14}, _{15}, _{58}), (_{18}, _{19}, _{62}), (_{22}, _{23}, _{45}), (_{26}, _{27}, _{49}), (_{30}, _{31}, _{53}), (_{34}, _{35}, _{57}), (_{38}, _{39}, _{61}) and (_{42}, _{43}, _{65}), are added to the point, and then, direct doubling by a width of two is conducted. Afterwards, then, elements, including (_{0}, _{1}, _{44}), (_{4}, _{5}, _{48}), (_{8}, _{9}, _{52}), (_{12}, _{13}, _{56}), (_{16}, _{17}, _{60}), (_{20}, _{21}, _{64}), (_{24},_{25},_{47}), (_{28},_{29},_{50}), (_{32},_{33},_{55}), (_{36},_{37},_{59}) and (_{40},_{41},_{63}), are added for completion.

For the hybrid model in _{0},_{1},_{16}), (_{2},_{3},_{18}), (_{4},_{5},_{20}), (_{6},_{7},_{22}), (_{8},_{9},_{17}), (_{10},_{11},_{19}), (_{12},_{13},_{21}), (_{14},_{15},_{23})]. Secondly, elements from 24 to 65 are grouped in this order: [(_{24}, _{25}, _{26}), (_{27}, _{28}, _{29}), (_{30}, _{31}, _{32}), (_{33}, _{34}, _{35}), (_{36}, _{37}, _{38}), (_{39}, _{40}, _{41}), (_{42},_{43},_{44}), (_{45},_{46},_{47}), (_{48},_{49},_{50}), (_{51},_{52},_{53}), (_{54},_{55},_{56}), (_{57},_{58},_{59}), (_{60}, _{61}, _{62}), (_{63}, _{64}, _{65})]. After table construction, the scalar multiplication process is started. Firstly, elements, including (_{27}, _{28}, _{29}), (_{33}, _{34}, _{35}), (_{39}, _{40}, _{41}), (_{45}, _{46}, _{47}), (_{51}, _{52}, _{53}), (_{57}, _{58}, _{59}) and (_{63}, _{64}, _{65}), are added to the point, and then, doubling is conducted. Secondly, elements, including (_{2}, _{3}, _{18}), (_{6}, _{7}, _{22}) and (_{10}, _{11}, _{19}), are added to the point, and then, direct doubling by a width of two is conducted. Finally, elements, including (_{0}, _{1}, _{16}), (_{4}, _{5}, _{20}), (_{8}, _{9}, _{17}), (_{12}, _{13}, _{21}), (_{14}, _{15}, _{23}), (_{24}, _{25}, _{26}), (_{30}, _{31}, _{32}), (_{36}, _{37}, _{38}), (_{42}, _{43}, _{44}), (_{48}, _{49}, _{50}), (_{54}, _{55}, _{56}) and (_{60}, _{61}, _{62}), are added to the point.

Throughout this paper, we explored the proposed method on a fixed-point. However, we found that the method is also available for an unknown point. Ordinarily, _{w}_{0}, _{2}), (_{1}, _{3}), (_{4}, _{6}), (_{5}, _{7}), (_{8}, _{10}), (_{9}, _{11}), (_{12}, _{14}), (_{13}, _{15}), (_{16}, _{18}), (_{17}, _{19}), (_{20}, _{22}), (_{21}, _{23}), (_{24}, _{26}), (_{25}, _{27}), (_{28}, _{30}), (_{29}, _{31})]. This structure shows a higher zero occurrence ratio than previous method, and its result is available in _{0}, _{2}) is added, and then, one doubling process is conducted. Secondly, element (_{1}, _{3}) is added, and then, direct doubling by three is conducted. This process is repeated, until the end of computation.

In the _{2} representation for an unknown point.

The authors declare no conflict of interest.

Look-up table structure of Lim and Lee's method in a block form.

Look-up table structure of Tsaur and Chou's method in a block form for 2NAF.

Look-up table structure of Mohamed, Hashim and Hutter's method in a block form for 4NAF.

Look-up table structure of the proposed method in a block form for 4NAF.

Look-up table structure of (size-optimized) the proposed method in a block form for 3NAF (version 1).

Look-up table structure of the (size-optimized) proposed method in block form for 3NAF (version 2).

Look-up table structure of the (size-optimized) proposed method in block form for 4NAF (version 3).

Look-up table structure of the (size-optimized) proposed method in block form for 4NAF (version 4).

Look-up table structure of the (hybrid) proposed method in block form for 2NAF (speed-optimized model).

Look-up table structure of the (hybrid) proposed method in block form for 3NAF (version 1).

Look-up table structure of the (hybrid) proposed method in block form for 3NAF (version 2).

Look-up table structure of the (hybrid) proposed method in block form for 4NAF (version 3).

Look-up table structure of the (hybrid) proposed method in block form for 4NAF (version 4).

Frequency of scalar value represented in 2NAF.

Frequency of scalar value represented in 3NAF.

Frequency of scalar value represented in 4NAF.

Performance of hybrid model using fine-tuned features.

Look-up table structure of the traditional 2NAF method in block form.

Look-up table structure of the proposed 2NAF method in block form.

Relation of neighbor bit set in

2NAF | 1st | 3rd | 16 | ||

4th | 8 | 33 | |||

| |||||

2nd | 3rd | 0 | 0 | ||

4th | 8 | ||||

| |||||

3NAF | 1st | 4th | 128 | ||

5th | 128 | ||||

6th | 96 | 28 | |||

| |||||

2nd | 4th | 0 | 0 | ||

5th | 64 | ||||

6th | 64 | ||||

| |||||

3rd | 4th | 0 | 0 | ||

5th | 0 | 0 | |||

6th | 32 | ||||

| |||||

4NAF | 1st | 5th | 262,144 | ||

6th | 131,072 | 27 | |||

7th | 65,536 | 13 | |||

8th | 32,768 | 7 | |||

| |||||

2nd | 5th | 0 | 0 | ||

6th | 131,072 | ||||

7th | 65,536 | 29 | |||

8th | 32,768 | 14 | |||

| |||||

3rd | 5th | 0 | 0 | ||

6th | 0 | 0 | |||

7th | 65,536 | ||||

8th | 32,768 | 33 | |||

| |||||

4th | 5th | 0 | 0 | ||

6th | 0 | 0 | |||

7th | 0 | 0 | |||

8th | 32,768 |

Relation of neighbor bit reset in

2NAF | 1st | 3rd | 24 | |

4th | 20 | 45 | ||

| ||||

2nd | 3rd | 24 | 40 | |

4th | 36 | |||

| ||||

3NAF | 1st | 4th | 448 | |

5th | 416 | 33 | ||

6th | 400 | 32 | ||

| ||||

2nd | 4th | 576 | 32 | |

5th | 608 | |||

6th | 624 | |||

| ||||

3rd | 4th | 704 | ||

5th | 672 | 32 | ||

6th | 720 | |||

| ||||

4NAF | 1st | 5th | 491,520 | |

6th | 376,832 | 22 | ||

7th | 385,024 | 23 | ||

8th | 421,888 | 25 | ||

| ||||

2nd | 5th | 491,520 | 20 | |

6th | 638,976 | 26 | ||

7th | 647,168 | 26 | ||

8th | 684,032 | |||

| ||||

3rd | 5th | 622,592 | 22 | |

6th | 638,976 | 22 | ||

7th | 778,240 | 27 | ||

8th | 815,104 | |||

| ||||

4th | 5th | 688,128 | 23 | |

6th | 704,512 | 23 | ||

7th | 778,240 | 25 | ||

8th | 880,640 |

Performance evaluation for hybrid model in the case of our speed-optimized 2NAF; the bit section indicates the ratio of bits using our method and that of [

[ | ||||
---|---|---|---|---|

160 | 0 | 52.88 | 591.46 | 3.2 |

156 | 4 | 52.05 | 582.60 | 3.36 |

152 | 8 | 51.23 | 573.74 | 3.52 |

148 | 12 | 50.40 | 564.88 | 3.68 |

144 | 16 | 49.58 | 556.02 | 3.84 |

140 | 20 | 48.76 | 547.17 | 4 |

136 | 24 | 47.93 | 538.31 | 4.16 |

132 | 28 | 47.11 | 529.45 | 4.32 |

128 | 32 | 46.28 | 520.59 | 4.48 |

124 | 36 | 45.46 | 511.73 | 4.64 |

120 | 40 | 44.64 | 502.88 | 4.8 |

116 | 44 | 43.81 | 494.02 | 4.96 |

112 | 48 | 42.99 | 485.16 | 5.12 |

108 | 52 | 42.16 | 476.30 | 5.28 |

104 | 56 | 41.34 | 467.44 | 5.44 |

100 | 60 | 40.52 | 458.59 | 5.6 |

96 | 64 | 39.69 | 449.73 | 5.76 |

92 | 68 | 38.87 | 440.87 | 5.92 |

88 | 72 | 38.04 | 432.01 | 6.08 |

84 | 76 | 37.22 | 423.15 | 6.24 |

80 | 80 | 36.4 | 414.3 | 6.4 |

Performance evaluation for hybrid model in the case of 3NAF; versions 1 (V1) and 2 (V2) have the same table size. The bit section indicates the ratio of bits using our method and that of [

[ | ||||||
---|---|---|---|---|---|---|

162 | 0 | 33.38 | 33.38 | 382.5 | 389.5 | 6.5 |

150 | 12 | 33.12 | 32.77 | 378.9 | 386.73 | 7.8 |

138 | 24 | 32.86 | 32.16 | 375.32 | 383.96 | 9 |

126 | 36 | 32.6 | 31.55 | 371.74 | 381.19 | 10.3 |

114 | 48 | 32.35 | 30.93 | 368.15 | 378.42 | 11.6 |

102 | 60 | 32.09 | 30.32 | 364.56 | 375.65 | 12.9 |

90 | 72 | 31.83 | 29.71 | 360.98 | 372.88 | 14.2 |

78 | 84 | 31.57 | 29.1 | 357.39 | 370.11 | 15.4 |

66 | 96 | 31.31 | 28.49 | 353.80 | 367.34 | 16.7 |

Average percentage (%) of zero occurrences for a 160-bit scalar, tested using random number vectors from Blum-Blum-Shub (

2NAF | 24.20 | 44.70 | 33.90 | - | - | |

3NAF | 11.59 | 48.98 | 38.20 | 46.54 | 44.64 | |

4NAF | 6.35 | 40.38 | 18.43 | 44.10 | 44.57 |

Size (Kbyte) of the look-up table in the case of a 160-bit scalar (

2NAF | 0.12 | 0.16 | 0.08 | 0.16 | - | - |

3NAF | 0.28 | 3.00 | 0.24 | 3.00 | ||

4NAF | 0.60 | 145.80 | 0.64 | 145.80 |

Evaluation result of fixed-base scalar multiplication, where

Partial Table Implementation | |||

[ |
33 × |
6.48 | 27 × 0.24 |

Speed | 27 × |
54.00 | 18 × 3.00 |

V1 | 29 × |
15.84 | 18 × 0.88 |

| |||

Full Table Implementation | |||

[ |
33 × |
12.96 | 54 × 0.24 |

Speed | 27 × |
162.00 | 54 × 3.00 |

V1 | 29 |
47.52 | 54 |

Required number of finite field operations. Inv: inversion; Mul: multiplication; Sqr: squaring; overhead ratio: Inv = 8 × Mul, 4 × Sqr = 3 × Mul.

Addition | 1 | 2 | 1 |

Doubling | 1 | 2 | 2 |

Direct Doubling | 1 | (4r+1) | (4r+1) |

Evaluation result of fixed-base scalar multiplication under the pair condition (in terms of table size), where

Our size-optimized model | ||||||

SZ(V1) | 28.9A+2DD(2) | 30.9 | 75.7 | 46.9 | 357.8 | 15.8 |

SZ(V2) | 28.9A+3DD(2) | 31.9 | 84.7 | 55.9 | 381.5 | 15.8 |

| ||||||

Mohamed | ||||||

2NAF | 52.9A+DD(2) | 53.9 | 114.8 | 61.9 | 591.5 | 3.2 |

3NAF | 33.4A+DD(3) | 34.4 | 79.7 | 46.4 | 389.5 | 6.5 |

4NAF | 32.6A+DD(4) | 33.6 | 82.3 | 49.6 | 388.5 | 12.8 |

5NAF | 28.5A+DD(5) | 29.5 | 78.1 | 49.5 | 351.6 | 25.6 |

| ||||||

Mohamed | ||||||

2NAF | 52.9A | 52.9 | 105.8 | 52.9 | 568.7 | 6.4 |

3NAF | 33.4A | 33.4 | 66.7 | 33.4 | 358.7 | 13 |

4NAF | 32.6A | 32.6 | 65.3 | 32.6 | 350.8 | 25.6 |

5NAF | 28.5A | 28.5 | 57 | 28.5 | 306.4 | 51.2 |

Performance evaluation for the hybrid model in the case of 4NAF. V3 and V4 denote version 3 and 4, respectively. The bit section indicates the ratio of bits using our method and that of [

160 | 0 | 32.63 | 32.63 | 398.25 | 393.00 | 12.8 | 12.8 |

144 | 16 | 31.6 | 31.59 | 387.21 | 381.76 | 20.48 | 22.4 |

128 | 32 | 30.57 | 30.54 | 376.17 | 370.52 | 28.16 | 32 |

112 | 48 | 29.55 | 29.5 | 365.13 | 359.28 | 35.84 | 41.6 |

96 | 64 | 28.52 | 28.45 | 354.09 | 348.04 | 43.52 | 51.2 |

80 | 80 | 27.49 | 27.4 | 343.06 | 336.8 | 51.2 | 60.8 |

64 | 96 | 26.47 | 26.36 | 332.02 | 325.55 | 58.9 | 70.4 |

48 | 112 | 25.44 | 25.31 | 320.98 | 314.31 | 66.6 | 80 |

32 | 128 | 24.41 | 24.27 | 309.94 | 303.07 | 74.2 | 89.6 |