  In this paper we study the existing CRT-RSA countermeasures against
fault-injection at-tacks. In an attempt to classify them we get to achieve deep
understanding of how they work. We show that the many countermeasures that we
study (and their variations) actually share a number of common features, but
optimize them in different ways. We also show that there is no conceptual
distinction between test-based and infective countermeasures and how either one
can be transformed into the other. Furthermore, we show that faults on the code
(skipping instructions) can be captured by considering only faults on the data.
These intermediate results allow us to improve the state of the art in several
ways: (a) we fix an existing and that was known to be broken countermeasure
(namely the one from Shamir); (b) we drastically optimize an existing
countermeasure (namely the one from Vigilant) which we reduce to 3 tests
instead of 9 in its original version, and prove that it resists not only one
fault but also an arbitrary number of randomizing faults; (c) we also show how
to upgrade countermeasures to resist any given number of faults: given a
correct first-order countermeasure, we present a way to design a prov-able
high-order countermeasure (for a well-defined and reasonable fault model).
Finally, we pave the way for a generic approach against fault attacks for any
modular arithmetic computations, and thus for the automatic insertion of
countermeasures.
