A method for at least partially performing a cryptographic computation secured against error attacks, in particular encryption, decryption, signature generation or signature verification, wherein the cryptographic computation comprises an employment of a multiple Q = k ∗ P of a starting point P on an elliptic curve, the method comprising the steps of: a) Computing the k-fold multiple Q = k ∗ P of a starting point P of odd order on an elliptical curve E, wherein this computation, beginning with a set of small odd multiples of the starting point P, is effected through a sequence of duplications and of additions or subtractions of multiples of P, b) supplying the computed multiple Q for employment in the cryptographic computation, wherein - instead of computing the multiple Q = k ∗ P on the curve E directly: the multiple Q 1 = k ∗ P 1 on an extended curve E 1 is computed, wherein E 1 represents a modular extension of the curve E by a smaller auxiliary curve E 2, and wherein P 1 is a modular extension of the starting point P on the extended curve E 1; and: the result Q is established by modular reduction of the computed point Q 1 of the extended curve E 1 on the curve E; - for checking the computation of Q 1: the multiple Q 2 = k ∗ P 2 on the auxiliary curve E 2 is computed, and the point Q 1 computed on the extended curve E 1 is modularly reduced to the auxiliary curve E 2, to Q*; and - the result Q is only output at most if the result Q* of the modular reduction of point Q 1 of on the extended curve E 1 to the auxiliary curve E2 is equal to Q 2; wherein - the order of the point P 2, which is given by reduction of the point P 1 modulo of the auxiliary curve E 2, is divisible by a sufficiently high power of two 2 (e+1), so that upon the computation of the multiple Q 2 modulo of the auxiliary curve E 2, the infinitely distant point of E 2 never occurs as an intermediate result. a) Computing the k-fold multiple Q = k ∗ P of a starting point P of odd order on an elliptical curve E, wherein this computation, beginning with a set of small odd multiples of the starting point P, is effected through a sequence of duplications and of additions or subtractions of multiples of P, b) supplying the computed multiple Q for employment in the cryptographic computation, wherein - instead of computing the multiple Q = k ∗ P on the curve E directly: the multiple Q 1 = k ∗ P 1 on an extended curve E 1 is computed, wherein E 1 represents a modular extension of the curve E by a smaller auxiliary curve E 2, and wherein P 1 is a modular extension of the starting point P on the extended curve E 1; and: the result Q is established by modular reduction of the computed point Q 1 of the extended curve E 1 on the curve E; - for checking the computation of Q 1: the multiple Q 2 = k ∗ P 2 on the auxiliary curve E 2 is computed, and the point Q 1 computed on the extended curve E 1 is modularly reduced to the auxiliary curve E 2, to Q*; and - the result Q is only output at most if the result Q* of the modular reduction of point Q 1 of on the extended curve E 1 to the auxiliary curve E2 is equal to Q 2; wherein - the order of the point P 2, which is given by reduction of the point P 1 modulo of the auxiliary curve E 2, is divisible by a sufficiently high power of two 2 (e+1), so that upon the computation of the multiple Q 2 modulo of the auxiliary curve E 2, the infinitely distant point of E 2 never occurs as an intermediate result. - instead of computing the multiple Q = k ∗ P on the curve E directly: the multiple Q 1 = k ∗ P 1 on an extended curve E 1 is computed, wherein E 1 represents a modular extension of the curve E by a smaller auxiliary curve E 2, and wherein P 1 is a modular extension of the starting point P on the extended curve E 1; and: the result Q is established by modular reduction of the computed point Q 1 of the extended curve E 1 on the curve E; - for checking the computation of Q 1: the multiple Q 2 = k ∗ P 2 on the auxiliary curve E 2 is computed, and the point Q 1 computed on the extended curve E 1 is modularly reduced to the auxiliary curve E 2, to Q*; and - the result Q is only output at most if the result Q* of the modular reduction of point Q 1 of on the extended curve E 1 to the auxiliary curve E2 is equal to Q 2; wherein - the order of the point P 2, which is given by reduction of the point P 1 modulo of the auxiliary curve E 2, is divisible by a sufficiently high power of two 2 (e+1), so that upon the computation of the multiple Q 2 modulo of the auxiliary curve E 2, the infinitely distant point of E 2 never occurs as an intermediate result.