In ECC scalar multiplication, how do `add(Q, Q)` exceptions occur?
In ECC scalar multiplication, how do add(Q, Q) exceptions occur?


Probability that it occurs when performing multiplication for large random $k$ (allowed to exceed $l$) and $P$ a generator is $\mathcal O\left(\dfrac{\log(k)}l\right)$ for a random $n$-bit curve, thus negligible when using actual curve parameters. Thus it can occur only when fed incorrect parameters; the cryptosystem or hardware is under attack; or using toy-size parameters making the crytosystem insecure.


  So add(Q, Q) can indeed not occur. □


I see no gap in the question's proof, now that it is explicitly stated that $P$ is on the curve, thus itself has prime order $l$.


  Using the DoubleAndAdd algorithm above, is it possible for any exceptions to occur in the addition in line 5?


No for correct execution (including, no induced fault attack) and parameters: $P$ on the curve of prime order $l$, $P\ne\infty$, $0\le k&lt;l$.