  In this article, we describe a methodology that aims at either breaking or
proving the security of CRT-RSA implementations against fault injection
attacks. In the specific case-study of the BellCoRe attack, our work bridges a
gap between formal proofs and implementation-level attacks. We apply our
results to three implementations of CRT-RSA, namely the unprotected one, that
of Shamir, and that of Aum\"uller et al. Our findings are that many attacks are
possible on both the unprotected and the Shamir implementations, while the
implementation of Aum\"uller et al. is resistant to all single-fault attacks.
It is also resistant to double-fault attacks if we consider the less powerful
threat-model of its authors.
