Apparatus for performing a fault detection operation and method thereof

Abstract

An apparatus for performing a fault detection operation and methods thereof are provided. The example apparatus may include a first-coordinate computing unit receiving a first point and a second point in a prime finite field, the first and second points established based on a basic point within a given elliptic curve, each of the first and second points including a first coordinate value and a second coordinate value, the first-coordinate computing unit performing a first addition operation on the first point and the second point to compute a third coordinate value and a second-coordinate computing unit performing a second addition operation on the first and second points to compute a fourth coordinate value, the first and second addition operations computed based on at least one of a difference between the first coordinate values of the first and second points and a difference between the second coordinate values of the first and second points.

Description

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings are included to provide a further understanding of the invention, and are incorporated in and constitute a part of this specification. The drawings illustrate example embodiments of the present invention and, together with the description, serve to explain principles of the present invention.

FIG. 1 is a flowchart illustrating a Calculate Twice and Check (CT&C) process corresponding to a conventional Differential Fault Analysis (DFA) countermeasure.

FIG. 2 is a flowchart illustrating a Check the Output Point (COP) process corresponding to another conventional DFA countermeasure.

FIG. 3 is a flowchart illustrating a Montgomery Power Ladder Algorithm (MPLA) process for performing the scalar multiplication within a conventional Elliptic Curve Cryptography (ECC) system.

FIG. 4 is a flowchart illustrating a fault checking process according to an example embodiment of the present invention.

FIG. 5 is a flowchart illustrating a fault checking process according to another example embodiment of the present invention.

FIG. 6 is a flowchart illustrating a fault checking process according to another example embodiment of the present invention.

FIG. 7 is a flowchart illustrating a process of adding points in a prime finite field to perform a fault detecting process used in a fast MPLA (FMPLA) according to another example embodiment of the present invention.

FIG. 8 is a circuit diagram of an apparatus for adding points in the prime finite field to perform a fault detecting process using the FMPLA, according to another example embodiment of the present invention.

FIG. 9 is a circuit diagram of an apparatus for adding points in the prime finite field to perform a fault detecting process using the FMPLA, according to another example embodiment of the present invention.

FIG. 10 illustrates a squaring unit according to another example embodiment of the present invention.

DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

Detailed illustrative example embodiments of the present invention are disclosed herein. However, specific structural and functional details disclosed herein are merely representative for purposes of describing example embodiments of the present invention. Example embodiments of the present invention may, however, be embodied in many alternate forms and should not be construed as limited to the embodiments set forth herein.

Accordingly, while example embodiments of the invention are susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will herein be described in detail. It should be understood, however, that there is no intent to limit example embodiments of the invention to the particular forms disclosed, but conversely, example embodiments of the invention are to cover all modifications, equivalents, and alternatives falling within the spirit and scope of the invention. Like numbers may refer to like elements throughout the description of the figures.

It will be understood that, although the terms first, second, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and, similarly, a second element could be termed a first element, without departing from the scope of the present invention. As used herein, the term “and/or” includes any and all combinations of one or more of the associated listed items.

It will be understood that when an element is referred to as being “connected” or “coupled” to another element, it can be directly connected or coupled to the other element or intervening elements may be present. Conversely, when an element is referred to as being “directly connected” or “directly coupled” to another element, there are no intervening elements present. Other words used to describe the relationship between elements should be interpreted in a like fashion (e.g., “between” versus “directly between”, “adjacent” versus “directly adjacent”, etc.).

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments of the invention. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising,”, “includes” and/or “including”, when used herein, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.

Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and will not be interpreted in an idealized or overly formal sense unless expressly so defined herein.

First, a Fast Montgomery Power Ladder Algorithm (FMPLA) according to an example embodiment of the present invention will be described, followed by a fault detecting process based upon the example FMPLA according to other example embodiments of the present invention.

In an example fault detecting process, Equation 7 (below) may be derived from conventional Equations 2 and 3:

H _j=2L_j+1+k_j+1=L_j+1+H_j+1+k_j=2H_j+1+k_j−1   Equation 7

Equation 8 (below) may then be derived based on Equation 7, as shown below:

H _j =L _j+1 2H_j+1=H_j+1|_{if (kj=0)}   Equation 8

wherein H_j=L_j+1 may be expressed as shown in conventional Equation 2.

In order to determine whether an error or fault is injected in a previous computation, H_j and L_j may be included in a computation. A Montgomery process, in which the sum of two points P₁ and P₂ may be computed on X-axis coordinates without X-axis coordinates, may be based on information relating to the difference between the two points P₁ and P₂.

In order to use the Montgomery process to derive a fault checking operation, and satisfy the indistinguishability operation equilibrium according to power tracks analysis, two example conditions based on which logic level k_j is set to may be employed.

In a first example condition, if k_j is equal to a first logic level (e.g., a higher logic level or logic “1”, such that k_j=1), a fault checking operation may be performed as follows:

• 1. L_j−1 may be computed by performing a “double” operation by:

L _j−1 =2L_j+1+k_j−1|_{if (kj=1)}=2L_j+1   Equation 9

• 2. L_j+1 may be computed by performing an addition operation on the result the double operation.
• 3. L_j+1=H_j may be checked for a fault or error. Here, H_j may denote a previously computed value.

In a second example condition, if k_j is equal to a second logic level (e.g., a lower logic level or logic “0”, such that k_j=0), the fault checking operation may be performed as follows:

• 1. 2H_j+1 may be computed by performing the double operation by:

H _j+1=2H_j+1+k_j−1+1|_{if (kj=0)}=2H_j+1   Equation 10

• 2. H_j+1 may be computed by performing the addition, in consideration of L_j.
• 3. H_j+1=2H_j+1 may be determined. Here, 2H_j+1 may denote a previously computed value.

In an example, if a fault or error is not injected into the system, the difference between L_j and H_j may be equal to “1”. Thus, if a fault is not injected in the above operation, L_j+1=H_j and/or H_j+1=2H_j+1. Also, H_j and L_j may be used in the determination as to whether L_j+1=H_j and/or whether H_j+1=2H_j+1, such that a determination as to whether a fault or error has occurred may be performed with respect to each of the two computed points.

Example embodiments of a fault checking process based on FMPLA will now be described in greater detail. In an example, a regular checking process and/or a random checking process may be performed to determine whether a fault or error is injected during performing the scalar multiplication. Further, an at-the-end checking process may be performed to determine whether a fault or error is injected, after performing the scalar multiplication and/or prior to outputting of a result of performing the scalar multiplication.

For example, the regular checking process may be performed to determine whether a fault or error is injected for each iteration or repetition of the scalar multiplication. In another example, the random checking process may be performed during the scalar multiplication only at randomly selected iterations or repetitions, and not necessarily for each iteration or repetition.

FIG. 4 is a flowchart illustrating a fault checking process 400 according to an example embodiment of the present invention. In the example embodiment of FIG. 4, checking may be performed for each iteration of a repeated portion of a scalar multiplication process. Generally, in the example embodiment of FIG. 4 basic point P and a scalar k may be received (at S401), and k and P may be used to perform scalar multiplication Q(=k×P) (at S429).

In the example embodiment of FIG. 4, the basic point P, which may be located on a given elliptic curve, may be stored in memory (e.g., an EEPROM). The scalar k has been described above respect to conventional Equation 2 in the Background of the Invention section. The basic point P and the scalar k may be received (at S401), and parameters or points for encryption may be reset or set (at S403).

In the example embodiment of FIG. 4, a first point P₁ and a second point P₂ may be reset using the basic point P (at S403). For example, the first point P₁ may be reset to the basic point P and the second point P₂ may be reset to double or twice that of the basic point P. After resetting the parameters (at S403), a repetitive operation may be performed to compute the scalar multiplication Q (at S405 through S413 and S427).

In the example embodiment of FIG. 4, counter i may designate a given bit among a number of binary bits within scalar k. In an example, the counter i may initially be set (e.g., during a first iterative of the repetitive or loop process) to one minus the maximum number of repetitions of the repetitive operation of FIG. 4 (at S405 through S413 and S427). Thus, for each repetition, the counter i may be decremented by 1 (at S405). Then, temporary variables T₁ and T₂ may be set to be equal to P₁ and P₂, respectively (at S407). If binary bit k_i is equal to a first logic level (e.g., a higher logic level or logic “1”) (at S409), then P₂ may be “doubled” and T₂ may be added to P1 (at S411). Otherwise, if binary bit k_i is equal to a second logic level (e.g., a lower logic level or logic “0”) (at S409), then P₁ may be “doubled” and T₁ may be added to P2.

In the example embodiment of FIG. 4, whether a fault is injected may be checked during each resetting of the variables and/or points, thus that fault-checking may be performed continuously (e.g., not just after all iterations of the repetitive operation). An operation of checking whether a fault is injected will now be described (S415 through S423).

In the example embodiment of FIG. 4, the binary bit k_i may be analyzed to determine the binary bit k_i corresponds to the first or second logic level (at S415). If the binary bit k_i is determined to correspond to the first logic level (e.g., a higher logic level or logic “1”), T1 may be “doubled”, and the sum of the first point P₁, which may be determined based on the first variable T₁ and the basic point P, may be reset to the first variable T₁ (at S417). The second point P₂ may then be compared with the reset first variable T₁ (at S419). If the second point P₂ and the reset first variable T₁ are equal to each other, a determination may be made that a fault has not been injected into the system; otherwise, a determination may be made that a fault has been injected into the system.

In the example embodiment of FIG. 4, if the binary bit k_i is equal to the second logic level (e.g., a lower logic level or logic “0”) (at S415), the second variable T₂ may be doubled, and the sum of the second point P₂, that may be determined according to the first variable T₁ and the basic point P, may be reset to the first variable T₁ (at S421). The doubled second variable T₂ may then be compared with the reset first variable T₁ (at S423). If the doubled second variable T₂ and the reset first variable T₁ are equal to each other, a determination may be made that a fault has not been injected into the system; otherwise, a determination may be made that a fault has been injected into the system.

In the example embodiment of FIG. 4, if it is determined that a fault is not injected (e.g., at S419 or S423), a determination may be made as to whether the counter i is less than 0 (at S427). If it is determined that the counter i is not less than 0, the process 400 may return to S405. Otherwise, if the counter i is less than 0, the first point P₁ may be output as the scalar multiplication Q (at S429). Otherwise, if it is determined that a fault is injected (e.g., at S419 or S423), a warning signal may be output (at S425).

FIG. 5 is a flowchart illustrating a fault checking process 500 according to another example embodiment of the present invention. In the example embodiment of FIG. 5, fault checking may be performed after a series of repetitive scalar multiplications. Thus, similar to the process 400 of FIG. 4, a first point and a second point may be reset according to a binary bit k_i (at S511 and S513). Then, a determination may be made as to whether the counter i is less than zero (at S515). As shown in the example embodiment of FIG. 5, the process 500 of FIG. 5 may be similar to the process 400 of FIG. 4 except that the determination of S427 may be moved to the position of S515 in FIG. 5, such that the “fault checking” steps may correspond to S517 to S527 in FIG. 5 (e.g., after the repetitive process or loop) as opposed to S415 to S427 (e.g., during each iteration of the repetitive process or loop).

FIG. 6 is a flowchart illustrating a fault checking process 600 according to another example embodiment of the present invention. In the example embodiment of FIG. 6, an example “random” checking process may be performed to determine whether a fault is injected into the system after a scalar multiplication is performed

In the example embodiment of FIG. 6, S601 may correspond to S501 of FIG. 5 and/or S401 of FIG. 4. S603 may also correspond to S503 of FIG. 5 and/or S403 of FIG. 4. However, in S603, a checking rate RATE may be set along with the parameters for encryption. A checking value CHECK, which may be randomly generated, may then be received (in S605). For example, both the checking value CHECK and the checking rate RATE may be in a range from 0 to 100. If the checking rate RATE is set to 70, and the randomly-generated checking value CHECK is 70 or less, a fault checking process (e.g., S619 through S625) may be performed. Otherwise, if the checking value CHECK is greater than 70, the fault checking process may not be performed and the process 600 may advance directly to S631.

Accordingly, it will be appreciated that the fault checking process may be performed for less than all of the binary bits k_i, based on the values of the randomly-generated checking value CHECK and the established checking rate RATE. The checking rate RATE may be used to determine the frequency of checking whether a fault is injected.

In the example process 400 through 600 illustrated in FIGS. 4 through 6, respectively, the “double” operation and the addition may be performed on points on an elliptic curve in order to reset a first point P₁ and a second point P₂. However, as described above, if the addition expressed in Equation 6 is used as the addition performed in 413, 417, 519, 523, 621, and/or 625, it may not be possible to perfectly perform fault detection.

FIG. 7 is a flowchart illustrating a process 700 of adding points in a prime finite field to perform a fault detecting process used in a FMPLA according to another example embodiment of the present invention.

In the example embodiment of FIG. 7, a first coordinate (X₃) may be computed by performing an addition operation based on a first point and a second point in the prime finite field (at S720). In an example, the first and second points may be set using a basic point on an elliptic curve, in the prime finite field (S720). A second coordinate (Z₃) may then be computed by performing another addition operation on the first point and the second point in the prime finite field (at S740).

A result P₃(X₃, Z₃) of performing the addition on the first and second points P₁ and P₂ in the prime finite field may be expressed as follows:

$\begin{array}{cc}\{\begin{array}{c}{X}_3=\begin{array}{c}{Z}_D\left[\begin{array}{c}2\left(X_1Z_2+X_2Z_1\right)\left(X_1X_2+{\mathrm{aZ}}_1Z_2\right)+\\ 4{\mathrm{bZ}}_1^2Z_2^2\end{array}\right]-\\ {X_D\left(X_1Z_2-X_2Z_1\right)}^2\end{array}\\ Z_3={Z_D\left(X_1Z_2-X_2Z_1\right)}^2\end{array}\hspace{1em}& \mathrm{Equation}11\end{array}$

wherein a and b may denote “invariables” used in the addition. The implementation of the invariables a and b will be readily appreciated by one of ordinary skill in the art, and as such a further description thereof has been omitted for the sake of brevity.

In another example, a basic point P may indicate a point on Affine coordinates, and thus, the second coordinate of the second point P₂ may be replaced with a “1”. In an example, the result P₃(X₃, Z₃) of performing the addition on the first and second points P₁ and P₂ in the prime finite field may be expressed as follows:

$\begin{array}{cc}\{\begin{array}{c}{X}_3=\begin{array}{c}{Z}_D\left[2\left(X_1+X_2Z_1\right)\left(X_1X_2+{\mathrm{aZ}}_1\right)+4{\mathrm{bZ}}_1^2\right]-\\ {X_D\left(X_1-X_2Z_1\right)}^2\end{array}\\ Z_3={Z_D\left(X_1-X_2Z_1\right)}^2\end{array}\hspace{1em}& \mathrm{Equation}12\end{array}$

As illustrated in Equations 11 and 12, the difference Z_D between the second coordinates of the first and second points P₁ and P₂ may be used during the addition operation for two points (P₁ and P₂) in the prime finite field, thereby more accurately or precisely performing a fault detecting process using the Montgomery algorithm.

FIG. 8 is a circuit diagram of an apparatus 800 for adding points in the prime finite field to perform a fault detecting process using the FMPLA, according to another example embodiment of the present invention.

In the example embodiment of FIG. 8, the apparatus 800 may include a first-coordinate computing unit and a second-coordinate computing unit. The first-coordinate computing unit may compute a first coordinate X₃ by performing the addition on a first point P₁ and a second point P₂, with the first and second points P₁ and P₂ being set using a basic point on an elliptic curve, in the prime finite field. The second-coordinate computing unit may compute a second coordinate Z₃ by performing an addition on the second coordinates of the first point P₁ and the second point P₂ in the prime finite field.

In the example embodiment of FIG. 8, the first and second-coordinate computing units may respectively compute the first and second coordinates X₃ and Z₃ based on the difference between the second coordinates of the first and second points P₁ and P₂.

In the example embodiment of FIG. 8, the first-coordinate computing unit may include first through seventh multipliers X1 through X7, first through fourth adders +1 through +4, first and second computing unit C11 and C12, and a first subtractor −1. The first multiplier X1 may compute a first multiplication value (X₁×Z₂) by multiplying X₁ by Z₂. The second multiplier X2 may compute a second multiplication value (X₂×Z₁) by multiplying X₂ by Z₁. The first adder +1 may compute a first addition value (X₁×Z₂+X₂×Z₁) by adding the first multiplication value and the second multiplication value.

In the example embodiment of FIG. 8, the third multiplier X3 may compute a third multiplication value (X₁×X₂) by multiplying X₁ by X₂. The fourth multiplier X4 may compute a fourth multiplication value (Z₁×Z₂) by multiplying Z₁ by Z₂. The fifth multiplier X5 may compute a fifth multiplication value (a×Z₁×Z₂) by multiplying the fourth multiplication value by a first given value a. The second adder +2 may compute a second addition value (X₁×X₂+a×Z₁×Z₂) by adding the third multiplication value and the fifth multiplication value. The sixth multiplier X6 may compute a sixth multiplication value ((X₁×Z₂+X₂×Z₁)×(X₁×X₂+a×Z₁×Z₂) by multiplying the first addition value by the second addition value. The third adder +3 may compute a third addition value (2×(X₁×Z₂+X₂×Z₁)×(X₁×X₂+a×Z₁×Z₂)), which may be twice (e.g., double) that of the sixth multiplication value, by adding the sixth multiplication value with the sixth multiplication value (e.g., itself).

In the example embedment of FIG. 8, the first computing unit C11 may compute a first computation value (4×b×Z₁²×Z₂²) by squaring the double of the fourth multiplication value and multiplying the squaring result by a second given value b. The first computing unit C11 may include an adder +11, a squaring unit S11 and a multiplier X11. The adder +11 may compute a addition value (2×Z₁×Z₂), which may be twice (e.g., double) that of the fourth multiplication value, by adding the fourth multiplication value with the fourth multiplication value (e.g., itself). The squaring unit S11 may compute a square (4×Z₁²×Z₂²) by squaring the addition value of the adder +11. The multiplier X11 may compute the first computation value by multiplying the square (4×Z₁²×Z₂²) of the squaring unit S11 by b.

In the example embodiment of FIG. 8, the fourth adder +4 may compute a fourth addition value (2×(X₁×Z₂+X₂×Z₁)×(X₁×X₂+a×Z₁×Z₂)+4×b×Z₁²×Z₂²) by adding the third addition value and the first computation value. The seventh multiplier X7 may compute a seventh multiplication value (Z_D×[2×(X₁×Z₂+X₂×Z₁)×(X₁×X₂+a×Z₁×Z₂)+4×b×Z₁²×Z₂²]) by multiplying the fourth addition value by Z_D.

In the example embodiment of FIG. 8, the second computing unit C12 may compute a second computation value (X_D×(X₁×Z₂−X₂×Z₁)²) by subtracting the second multiplication value from the first multiplication value, squaring the subtracting result, and multiplying the squaring result by X_D. The second computing unit C12 may include a subtractor −12, a squaring unit S12, and a multiplier X12. The subtractor −12 may compute a subtraction value (X₁×Z₂−X₂×Z₁) by subtracting the second multiplication value from the first multiplication value. The squaring unit S12 may compute a square ((X₁×Z₂−X₂×Z₁)²) by squaring the subtraction value (X₁×Z₂−X₂×Z₁) of the subtractor −12. The multiplier X12 may compute the second computation value by multiplying the square of the squaring unit S12 by X_D.

In the example embodiment of FIG. 8, the first subtractor −1 may subtract the second computation value from the seventh multiplication value to compute an X coordinate (X₃), which may be a result obtained by performing the addition on the first and second points.

In the example embodiment of FIG. 8, the second-coordinate computing unit C22 may include multipliers X21, X22, and X23, a subtractor −21, and a squaring unit S21. The multiplier X21 may compute a multiplication value (X₁×Z₂) by multiplying X₁ by Z₂. The multiplier X22 may compute a multiplication value (X₂×Z₁) by multiplying X₂ by Z₁. The subtractor −21 may compute a subtraction value (X₁×Z₂−X₂×Z₁) by subtracting the multiplication value of multiplier X22 from the multiplication value of multiplier X21.

In the example embodiment of FIG. 8, the squaring unit S21 may compute a square ((X₁×Z₂−X₂×Z₁)²) by squaring the addition value of the adder +23. The multiplier X23 may compute a Z coordinate (Z₃) by multiplying the square of the squaring unit S21 by Z_D. In an example, the multiplier X21 and the multiplier X22 may correspond to the first multiplier X1 and the second multiplier X2 of the first-coordinate computing unit. In another example, the subtractor −21 and the squaring unit S21 may correspond to the subtractor −12 and the squaring unit S12 of the second computing unit C12.

In an example, Equation 11 may be computed by the apparatus 800 of FIG. 8, and Equation 12 may be computed by another example apparatus for adding points in the prime finite field, which will now be described with reference to FIG. 9.

FIG. 9 is a circuit diagram of an apparatus 900 for adding points in the prime finite field to perform a fault detecting process using the FMPLA, according to another example embodiment of the present invention.

In the example embodiment of FIG. 9, the example operation of the apparatus 900 may be the same as that of the apparatus 800 of FIG. 8, except that the apparatus 900 of FIG. 9 may further perform the addition on points if a second coordinate (e.g., a Z coordinate) of second point P₂ is equal to the first logic level (e.g., a higher logic level or logic “1”). Therefore, the apparatus 900 may be structurally similar to that of the apparatus 800 of FIG. 8, while including fewer multipliers as compared to the apparatus 800. In another example, a construction and operation of the first-coordinate computing unit and the second-coordinate computing unit of the apparatus 900 may be the same as that of the apparatus 800 of FIG. 8.

FIG. 10 illustrates a squaring unit S according to another example embodiment of the present invention. In an example, the example squaring unit S may be included as the squaring units described above with respect to the example embodiments of FIGS. 8 and/or 9.

In the example embodiment of FIG. 10, the squaring unit S may multiply a given input value I1 by itself. In an example, the squaring unit S may correspond to the squaring unit S11 and/or the squaring unit S12 illustrated in FIGS. 8 and 9. The squaring unit S may be configured such that an input value may be multiplied by itself, thereby reducing a layout area of the apparatus 800 and/or 900 of FIGS. 8 and 9, respectively.

In another example embodiment of the present invention, a method and apparatus for adding points in the prime finite field may be capable of more accurately or precisely performing a fault detecting process in a cryptographic system that uses the FMPLA.

Example embodiments of the present invention being thus described, it will be obvious that the same may be varied in many ways. For example, while the example embodiments of charge pump circuits are above described directed to FMPLA, it is understood that other example embodiments of the present invention may be directed to any well-known fault detection process (e.g. MPLA, etc.).

Further, it is understood that the above-described first and second logic levels may correspond to a higher level and a lower logic level, respectively, in an example embodiment of the present invention. Alternatively, the first and second logic levels/states may correspond to the lower logic level and the higher logic level, respectively, in other example embodiments of the present invention.

Such variations are not to be regarded as a departure from the spirit and scope of example embodiments of the present invention, and all such modifications as would be obvious to one skilled in the art are intended to be included within the scope of the following claims.

Claims

1. A method of performing a fault detection operation, comprising: determining a first point and a second point in a prime finite field, the first and second points established based on a basic point within a given elliptic curve, each of the first and second points including a first coordinate value and a second coordinate value;performing a first addition operation on the first point and the second point to compute a third coordinate value; andperforming a second addition operation on the first and second points to compute a fourth coordinate value, the first and second addition operations computed based on at least one of a difference between the first coordinate values of the first and second points and a difference between the second coordinate values of the first and second points.

2. The method of claim 1, wherein the fault detecting operation is performed within an elliptic curve cryptography system employing a fast Montgomery power ladder algorithm (FMPLA).

3. The method of claim 1, wherein the first coordinate values and the third coordinate value correspond to X-axis coordinates and the second coordinate values and the fourth coordinate value correspond to Z-axis coordinates.

4. The method of claim 3, wherein, if the first point is denoted as P1(X1, Z1), the second point is denoted as P2(X2, Z2), a difference point between P1 and P2 is denoted as PD(XD,ZD), the third coordinate value is denoted as X3, the fourth coordinate value is denoted as Z3, and a resultant point is denoted as P3(X3, Z3), the first and second additional operations are respectively represented as follows:

5. The method of claim 4, wherein the second coordinate value of the second point (Z2) is equal to 1.

6. The method of claim 1, wherein the second coordinate value of the second point has a fixed value.

7. The method of claim 6, wherein the fault detecting operation is performed within an elliptic curve cryptography system employing a fast Montgomery power ladder algorithm (FMPLA).

8. The method of claim 6, wherein the first coordinate values and the third coordinate value correspond to X-axis coordinates and the second coordinate values and the fourth coordinate value correspond to Z-axis coordinates.

9. The method of claim 8, wherein the second coordinate value of the second point is equal to 1.

10. The method of claim 9, wherein, if the first point is denoted as P1(X1, Z1), the second point is denoted as P2(X2, 1), a difference point between P1 and P2 is denoted as PD(XD,ZD), the third coordinate value is denoted as X3, the fourth coordinate value is denoted as Z3, and a resultant point is denoted as P3(X3, Z3), the first and second additional operations are respectively represented as follows:

11. An apparatus for performing a fault detection operation, comprising: a first-coordinate computing unit receiving a first point and a second point in a prime finite field, the first and second points established based on a basic point within a given elliptic curve, each of the first and second points including a first coordinate value and a second coordinate value, the first-coordinate computing unit performing a first addition operation on the first point and the second point to compute a third coordinate value; anda second-coordinate computing unit performing a second addition operation on the first and second points to compute a fourth coordinate value, the first and second addition operations computed based on at least one of a difference between the first coordinate values of the first and second points and a difference between the second coordinate values of the first and second points.

12. The apparatus of claim 11, wherein the first and second coordinate computing units are included within an elliptic curve cryptography system employing a fast Montgomery power ladder algorithm (FMPLA).

13. The method of claim 11, wherein the first coordinate values and the third coordinate value correspond to X-axis coordinates and the second coordinate values and the fourth coordinate value correspond to Z-axis coordinates.

14. The apparatus of claim 13, wherein, if the first point is denoted as P1(X1, Z1), the second point is denoted as P2(X2, Z2), a difference point between P1 and P2 is denoted as PD(XD,ZD), the third coordinate value is denoted as X3, the fourth coordinate value is denoted as Z3, and a resultant point is denoted as P3(X3, Z3), the first and second additional operations are respectively represented as follows:

15. The apparatus of claim 14, wherein the first-coordinate computing unit includes: a first multiplier computing a first multiplication value (X1×Z2) by multiplying X1 by Z2;a second multiplier computing a second multiplication value(X2×Z1) by multiplying X2 by Z1;a first adder computing a first addition value (X1×Z2+X2×Z1) by adding the first multiplication value and the second multiplication value;a third multiplier computing a third multiplication value (X1×X2) by multiplying X1 by X2;a fourth multiplier computing a fourth multiplication value (Z1×Z2) by multiplying Z1 by Z2;a fifth multiplier computing a fifth multiplication value (a×Z1×Z2) by multiplying the fourth multiplication value by a first given value a;a second adder computing a second addition value (X1×X2+a×Z1×Z2) by adding the third multiplication value and the fifth multiplication value;a sixth multiplier computing a sixth multiplication value ((X1×Z2+X2×Z1×(X1×X2+a×Z1×Z2) by multiplying the first addition value by the second addition value;a third adder computing a third addition value (2×(X1×Z2+X2×Z1)×(X1×X2+a×Z1×Z2) which is double the sixth multiplication value, by adding the sixth multiplication value with itself;a first computing unit computing a first computation value (4×b×Z12×Z22) by squaring the doubling of the fourth multiplication value and multiplying the squaring result by a second given value b;a fourth adder computing a fourth addition value (2×(X1×Z2+X2×Z1)×(X1×X2+a×Z1×Z2)+4×b×Z12×Z22) by adding the third addition value and the first computation value;a seventh multiplier computing a seventh multiplication value (ZD×[2×(X1×Z2+X2×Z1)×(X1×X2+a×Z1×Z2)+4×b×Z12×Z22]) by multiplying the fourth addition value by ZD;a second computing unit computing a second computation value XD×(X1×Z2−X2×Z1)2) by subtracting the second multiplication value from the first multiplication value, squaring the subtracting result, and multiplying the squaring result by XD; anda first subtractor computing the third coordinate value (X3), which is the result of performing the addition on the first point and the second point in the prime finite field, by subtracting the second computation value from the seventh multiplication value.

16. The apparatus of claim 15, wherein the first computing unit includes: an fifth adder computing a fifth addition value (2×Z1×Z2), which is the double of the fourth multiplication value, by adding the fourth multiplication value with the fourth multiplication value;a squaring unit computing a square (4×Z12×Z22) by squaring the fifth addition value; andan eighth multiplier computing the first computation value by multiplying the square by b.

17. The apparatus of claim 16, wherein the squaring unit multiplies the fifth addition value by the fifth addition value.

18. The apparatus of claim 15, wherein the second computing unit includes: a second subtractor computing a subtraction value (X1×Z2−X2×Z1) by subtracting the second multiplication value from the first multiplication value;a squaring unit computing a square ((X1×Z2−X2×Z1)2) by squaring the subtraction value; andan eighth multiplier computing the second computation value by multiplying the square by XD.

19. The apparatus of claim 18, wherein the squaring unit multiplies the subtraction value by the subtraction value.

20. The apparatus of claim 14, wherein the second-coordinate computing unit includes: a first multiplier computing a first multiplication value (X1×Z2) by multiplying X1 by Z2;a second multiplier computing a second multiplication value (X2×Z1) by multiplying X2 by Z1;a subtractor computing a subtraction value (X1×Z2−X2×Z1) by subtracting the second multiplication value from the first multiplication value;a squaring unit computing a square ((X1×Z2−X2×Z1)2) by squaring the subtraction value; anda third multiplier computing the fourth coordinate value (Z3) by multiplying the square by ZD.

21. The apparatus of claim 11, wherein the second coordinate of the second point has a fixed value.

22. The apparatus of claim 20, wherein the first and second coordinate computing units are included within an elliptic curve cryptography system employing a fast Montgomery power ladder algorithm (FMPLA).

23. The method of claim 22, wherein the first coordinate values and the third coordinate value correspond to X-axis coordinates and the second coordinate values and the fourth coordinate value correspond to Z-axis coordinates.

24. The apparatus of claim 23, wherein the second coordinate of the second point is equal to “1”.

25. The apparatus of claim 24, wherein, if the first point is denoted as P1(X1, Z1), the second point is denoted as P2(X2, 1), a difference point between P1 and P2 is denoted as PD(XD,ZD), the third coordinate value is denoted as X3, the fourth coordinate value is denoted as Z3, and a resultant point is denoted as P3(X3, Z3), the first and second additional operations are respectively represented as follows:

26. The apparatus of claim 25, wherein the first-coordinate computing unit includes: a first multiplier computing a first multiplication value(X2×Z1) by multiplying X2 by Z1;a first adder computing a first addition value (X1+X2×Z1) by adding the first multiplication value and X1;a second multiplier computing a second multiplication value(X1×X2) by multiplying X1 by X2;a third multiplier computing a third multiplication value (a×Z1) by multiplying Z1 by first given value a;a second adder computing a second addition value (X1×X2+a×Z1) by adding the second multiplication value and the third multiplication value;a fourth multiplier computing a fourth multiplication value ((X1+X2×Z1)×(X1×X2+a×Z1)) by multiplying the first addition value and the second addition value;a third adder computing a third addition value (2×(X1+X2×Z1)×(X1×X2+a×Z1)), which is the double of the fourth multiplication value, by adding the fourth multiplication value with the fourth multiplication value;a first computing unit computing a first computation value (4×b×Z12) by squaring the double of Z1 and multiplying the squaring result by a second given value b;a fourth adder computing a fourth addition value (2×(X1+X2×Z1)×(X1×X2+a×Z1)+4×b×Z12) by adding the third addition value and the first computation value;a fifth multiplier computing a fifth multiplication value (ZD×[2×(X1+X2×Z1)×(X1×X2+a×Z1)+4×b×Z12]) by multiplying the fourth addition value by ZD;a second computing unit computing a second computation value (XD×(X1−Z1×Z2)2) by subtracting the first multiplication value from X1, squaring the subtracting result, and multiplying the squaring result by the first multiplication value by XD; anda first subtractor computing the third coordinate value (X3) by subtracting the second computation value from the fifth multiplication value.

27. The apparatus of claim 26, wherein the first computing unit includes: a fifth adder computing a fifth addition value (2×Z1), which is double Z1, by adding Z1 with Z1;a squaring unit computing a square (4×Z12) by squaring the fifth addition value; anda sixth multiplier computing the first computation value by multiplying the square by b.

28. The apparatus of claim 27, wherein the squaring unit multiplies the fifth addition value by the fifth addition value.

29. The apparatus of claim 26, wherein the second computing unit includes: a second subtractor computing a subtraction value (X1−X2×Z1) by subtracting the first multiplication value from X1;a squaring unit computing a square ((X1−X2×Z1)2) by squaring the subtraction value; anda sixth multiplier computing the second computation value by multiplying the square by XD.

30. The apparatus of claim 29, wherein the squaring unit multiplies the subtraction value by the subtraction value.

31. The apparatus of claim 25, wherein the second-coordinate computing unit includes: a first multiplier computing a multiplication value (X2×Z1) by multiplying X2 by Z1;a subtractor computing a subtraction value (X1−X2×Z1) by subtracting X1 from the multiplication value;a squaring unit computing a square ((X1−X2×Z1)2) by squaring the subtraction value; anda second multiplier computing the fourth coordinate value (Z3) by multiplying the square by ZD.