**Error-free protection of EC point multiplication by modular extension**

*Martin Seysen*

**Abstract: **An implementation of a point multiplication function in an
elliptic-curve cryptosystem can be attacked by fault injections
in order to reveal the secret multiplier.
A special kind of such an attack is the sign-change fault attack.
Here the result of a point multiplication is changed in such a way
that it is still a point on the curve. A well-known countermeasure
against this kind of attack is
to perform the point multiplication on a modular extension of the
main curve by a small curve. Then the result is checked against the
result of the same point multiplication recalculated on the small curve.
The problem with this countermeasure is that the point at infinity
on the small curve may be reached as an intermediate result with a
non-negligible probability. In this case the comparison with
the result on the small curve is either faulty or meaningless.
We propose a variant of the
modular extension countermeasure where the point at infinity is
never reached as an intermediate result on the main or on
the small curve.

**Category / Keywords: **implementation / elliptic curve, point multiplication, modulus extension

**Date: **received 21 Feb 2017

**Contact author: **m seysen at gmx de

**Available format(s): **PDF | BibTeX Citation

**Version: **20170227:144823 (All versions of this report)

**Short URL: **ia.cr/2017/170

[ Cryptology ePrint archive ]