to Section III, the factorized algorithm computes (14) and (15) with 36 multiplications and 90 additions. Other symmetries of (14) and (15) can be exploited: the first terms of the sums in (14) and also the first of d, and the second of di', the first of d; and the second of dd, the first of di' and the second of d; are pairwise equal, therefore, only 18 multiplications and 48 additions in GF(2...