Faults can corrupt data in storage, in transit, or during a computation. Like other digital systems, cryptosystems are vulnerable to natural and artificial faults. However, the effects of faults on cryptosystems far suppress the corruption of data. Attacks that exploit various classes of faults to learn secret data have been proposed and shown to be practical. As such, efficient detection and recovery of errors resulting from faults have a growing importance in the design of cryptosystems. We tackle the problem of error detection and recovery for transient faults in elliptic curve scalar multiplication structures. We propose the use of frequent validation with partial recomputation during the scalar multiplication for more efficient error detection and recovery. In our approach, the scalar multiplication iterations are grouped into blocks and efficient error detection schemes are used to detect errors early, which significantly limits the propagation of corrupted data. Moreover, we use the same error detection schemes, combined with partial recomputation, to achieve efficient error recovery without requiring complete time and hardware redundancy. Our analysis illustrates that these modifications enable considerably more efficient and reliable structures relative to known error detection and recovery designs. 1

The use of fixed-block error recovery, which combines frequent validation and partial recomputation, to address the problem of transient faultsin elliptic curvescalarmultiplicationwasproposedearlierand its advantages in terms of efficiency and reliability were illustrated. However, in order to maximize its advantages, the selection of the block size has to be optimized, which requires knowledge of the statistical properties of errors. It was shown that this can be partially alleviated by selecting smaller block sizes. We introduce an alternative approach that aims to reduce the dependency on prior knowledge. Instead of using a fixed block size, we propose the use of an adaptive block size that varies depending on whether or not an error is detected. The performance of this approach is studied using an analytical model and simulationunder constantand variableerrorratesand the results show that it can approach, and in some cases exceed, the performance of the fixed-block error recovery approach while not requiring prior knowledge of the statistical properties of errors. 1