  The iterative conditional branchings appear in various sensitive algorithms,
like the modular exponentiation in the RSA cryptosystem or the scalar
multiplication in ellipticcurve cryptography. In this paper, we abstract away
the desirable security properties achieved by the Montgomery ladder, and
formalize systems of equations necessary to obtain what we call the
semi-interleaved and fully-interleaved ladder properties. This fruitful
approach allows us to design novel fault-injection attacks, able to obtain
some/all bits of the secret against different ladders, including the common
Montgomery ladder. We also demonstrate the generality of our approach by
applying the ladder equations to the modular exponentiation and the scalar
multiplication, both in the semi-and fully-interleaved cases, thus proposing
novel and more secure algorithms.
