Memory-efficient cryptographic computations in secure communications

Abstract

A computer-implemented method enhances the efficiency and security of cryptographic tasks for modular exponentiation, digital signatures, key generation, and blockchain transaction verification. The method includes receiving a cryptographic task, retrieving a set of operands from memory, decomposing them into smaller parameters to construct multiple cryptographic sub- tasks, allocating non-overlapping memory regions for each sub-task and processes them in parallel. For each sub-task, a pair of variables is initiated in memory, followed by a bit-by-bit iteration through one of the parameters. During this iteration, the variables are updated based on each bit value. Once the iteration is complete, the value of the first variable is stored as an intermediate result in the corresponding memory region. Upon completing all parallel sub-tasks, the device aggregates the intermediate results to produce the final output of the cryptographic task, which is then used to generate verification data for secure communication.

Description

Attorney Docket Number: 98WY-395043-WOMEMORY-EFFICIENT CRYPTOGRAPHIC COMPUTATIONS IN SECURE COMMUNICATIONSCROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to U.S. Provisional Patent Application No. 63 / 725,053, filed November 26, 2024, and titled “MEMORY-EFFICIENT CRYPTOGRAPHIC COMPUTATIONS IN SECURE COMMUNICATIONS,” the entire contents of which are hereby incorporated by reference.TECHNICAL FIELD

[0002] The disclosure relates to the field of cryptography and secure communications, specifically to methods and systems for accelerating the verification process and / or key generation in cryptographic communications.BACKGROUND

[0003] In today's digital world, secure communication between devices is more important than ever. Cryptographic algorithms form the backbone of security protocols that protect sensitive information during transmission, ensuring confidentiality, integrity, and authentication. Applications such as online banking, secure email, digital signatures, blockchain transactions, and encrypted messaging rely heavily on these cryptographic processes to maintain trust and prevent unauthorized access.

[0004] As security threats become more sophisticated, there is a growing demand for stronger encryption methods. This often involves using larger cryptographic keys. While larger keys enhance security by making it more difficult for adversaries to break the encryption, they also introduce significant challenges in terms of computational efficiency and resource utilization.

[0005] One of the primary challenges is the time and processing power required to perform cryptographic operations like verification and key generation with these large keys. These operations can be computationally intensive and slow, leading to delays in establishing secure communications or verifying digital signatures.

[0006] Moreover, devices such as smartphones, Internet of Things (loT) gadgets, and embedded systems often have limited processing capabilities and memory resources. Performing complex cryptographic computations on such devices can strain their resources, leading to increased power consumption and reduced battery life, which is a significant concern for mobile and portable devices.

[0007] Another challenge lies in the way traditional cryptographic algorithms process data. Many of these algorithms execute operations sequentially, where each step depends on the completion ofAttorney Docket Number: 98WY-395043-WO the previous one. This sequential dependency limits the ability to leverage modem computing architectures that are optimized for parallel processing. As a result, opportunities to improve performance through parallel execution on multi-core processors or specialized hardware accelerators are not fully utilized.SUMMARY

[0008] Various embodiments of the present specification may include systems, methods, and non- transitory computer readable media for accelerating cryptographic protocols like RSA or Diffie- Hellman key exchanges for secure communications among computing devices or systems.

[0009] In one general aspect, a computer-implemented method may include receiving, by a computing device, a cryptographic task as part of a secure communication with another computing device. The computer-implemented method may also include retrieving, by the computing device, a triad of operands of the cryptographic task from memory. The method may further include decomposing, by the computing device, the triad of operands into a plurality of smaller parameters. Additionally, the method may include constructing, by the computing device, a plurality of cryptographic sub-tasks based on the plurality of smaller parameters, and allocating, by the computing device, a plurality of memory regions of the memory for the cryptographic sub-tasks. The method may also include parallel processing, by the computing device, of the cryptographic sub-tasks, where the parallel processing involves, for each cryptographic sub-task: initiating a pair of variables in cache; iterating bit-by-bit through one of the smaller parameters corresponding to the cryptographic sub-task, and updating the pair of variables based on each bit value. Upon completing the bit-by-bit iteration, the method stores the value of a first variable from the pair as an intermediate result into the memory region associated with the cryptographic sub-task.

[0010] Once parallel processing is complete, the method includes aggregating, by the computing device, the intermediate results from the non-overlapping memory regions as an output of the cryptographic task. Finally, the method includes generating, by the computing device, verification data based on the output of the cryptographic task for secure communication between the computing device and the other computing device. Other embodiments of this aspect include corresponding computer systems, apparatuses, and computer programs recorded on one or more computer storage devices, each configured to perform the actions of the methods.

[0011] Implementations may include one or more of the following features. The method where the triad of operands may include a base, an exponent representing a cryptographic key, and a modulus, with one step of the cryptographic task involving modular exponentiation based on the base, exponent, and modulus. The method decomposing the triad of operands into a plurality of smallerAttorney Docket Number: 98WY-395043-WO parameters may include decomposing the modulus into smaller moduli and reducing the base and exponent with respect to each smaller modulus. The method where the base and exponent are reduced for bit- width alignment in hardware acceleration, where the bit width of intermediate values generated based on the reduced base and exponent during bit-by-bit iteration is less than the bitwidth limit of a register associated with a processing core. The method where updating the pair of variables based on each bit value includes loading the variables into registers associated with the processing core from the cache and updating them within the registers without transferring intermediate values to the cache, thereby accelerating the cryptographic sub-task. Another version of the method may involve in-place updating of the pair of variables within the cache without transferring intermediate values to memory, reducing memory access overhead during the bit-by- bit iteration. In the bit-by-bit iteration, the smaller parameter may be decomposed from a cryptographic key associated with the task, iterating bits in the parameter from most significant to least significant. Generating verification data for secure communication may involve creating an encryption key, digital signature, verification result, blockchain transaction verification result, or a partial signature as part of a Multi-Party Computation (MPC) verification task associated with an MPC digital wallet. The triad of operands may also be part of simultaneous congruences with pairwise coprime moduli. Implementations of the described techniques may include hardware, a method or process, or a computer tangible medium.

[0012] In one general aspect, a non-transitory computer-readable storage medium may include receiving a cryptographic task as part of secure communication with another computing device. The non-transitory computer-readable storage medium may also include retrieving a triad of operands of the cryptographic task from memory, decomposing the triad into smaller parameters, constructing cryptographic sub-tasks based on these parameters, and allocating non-overlapping memory regions for the sub-tasks. Additionally, the medium may include parallel processing of the cryptographic sub-tasks, where each sub-task includes initiating a pair of variables in cache, iterating bit-by-bit through one of the smaller parameters, updating the variables based on each bit value, and storing the result of a variable from the pair as an intermediate result in the associated memory region. Upon completing parallel processing, the medium may aggregate the intermediate results as output, generating verification data for the secure communication. Other embodiments of this aspect include corresponding computer systems, apparatuses, and programs on storage devices, each configured to perform the actions of the methods.

[0013] Implementations may include additional features, such as a non-transitory computer- readable storage medium where the triad includes a base, exponent, and modulus, with modularAttorney Docket Number: 98WY-395043-WO exponentiation based on these values. Decomposing the operands into smaller parameters may involve decomposing the modulus into smaller, coprime moduli, and reducing the base and exponent relative to each smaller modulus. For hardware acceleration, the base and exponent may be reduced for bit-width alignment, ensuring intermediate values remain below register limits. The updating process may load and update variables within registers without cache transfers, expediting the cryptographic sub-task. Implementations of these techniques may include hardware, a process, or a computer tangible medium.

[0014] In one general aspect, the system may include receiving a cryptographic task as part of secure communication, retrieving a triad of operands from memory, decomposing the triad into smaller parameters, constructing cryptographic sub-tasks based on these parameters, and allocating non-overlapping memory regions for the sub-tasks. The system may also perform parallel processing of the sub-tasks, each involving a pair of variables in cache, bit-by-bit iteration through one smaller parameter, and updating the pair based on bit values. Upon completion, the system aggregates intermediate results from memory regions as output, generating verification data for the communication. Other embodiments include corresponding systems, apparatuses, and programs on storage devices, each configured to perform the methods.

[0015] Implementations may include additional features, such as iterating bit-by-bit through a smaller parameter decomposed from a cryptographic key, iterating bits from most to least significant.

[0016] These and other features of the systems, methods, and non-transitory computer readable media disclosed herein, as well as the methods of operation and functions of the related elements of structure and the combination of parts and economies of manufacture, will become more apparent upon consideration of the following description and the appended claims with reference to the accompanying drawings, all of which form a part of this specification, wherein like reference numerals designate corresponding parts in the various figures. It is to be expressly understood, however, that the drawings are for purposes of illustration and description only and are not intended as a definition of the limits of the invention.BRIEF DESCRIPTION OF THE DRAWINGS

[0017] FIGs. 1A and IB illustrate example cryptographic communications among computing devices or systems.

[0018] FIG. 2 illustrates an example brute-force cryptographic process used in cryptographic communications.Attorney Docket Number: 98WY-395043-WO

[0019] FIG. 3 illustrates an improvement on the example brute-force cryptographic process shown in FIG. 2.

[0020] FIG. 4A illustrates a consistent bit-wise operation to accelerate modular exponentiation in a cryptographic operation with Side-Channel Attack Resistance, in accordance with some embodiments.

[0021] FIG. 4B illustrates a Number Theory-based process for segmenting and parallelizing modular exponentiation in a cryptographic operation, in accordance with some embodiments.

[0022] FIG. 5A illustrates a comparison among multiple methods of modular exponentiation for cryptographic communications, in accordance with some embodiments.

[0023] FIG. 5B illustrates an example flow diagram of a memory-efficient parallel processing scheme for cryptographic computation, in accordance with some embodiments.

[0024] FIGs. 6A-6C illustrate example applications of the memory-efficient parallel processing scheme for cryptographic computation, in accordance with some embodiments.

[0025] FIG. 7 illustrates an example method implementing the memory-efficient parallel processing scheme for cryptographic computation, in accordance with some embodiments.

[0026] FIG. 8 illustrates an example computing device in which any of the embodiments described herein may be implemented.DETAILED DESCRIPTION

[0027] Embodiments disclosed herein provide methods, systems, and apparatus associated with an ecosystem for accelerating cryptographic protocols for secure communications among computing devices or systems.

[0028] FIGs. 1A and IB illustrate example cryptographic communications among computing devices or systems. FIG. 1A illustrates processes for message encryption and decryption 100 in internet communication, and digital signature verification 110 in internet communication. In the example message encryption and decryption process 100 shown in FIG. 1A, a sender encrypts plain text using the receiver's public cryptographic key, which is published and accessible to the sender. The encrypted message is transmitted over a communication channel, which may be wired or wireless, and received by the receiver. The receiver decrypts the message using its private key — known only to the receiver — to recover the original plain text. This encryption-decryption process involves several cryptographic computations, including key generation, encryption with the public key, and decryption with the private key.

[0029] In the example digital signature verification process 110 illustrated in FIG. 1 A, the sender generates a digital signature by signing the message with its private key and sends the signedAttorney Docket Number: 98WY-395043-WO message through a communication channel, such as a wired or wireless connection, to the receiver. The receiver then uses the sender's public key to verify the authenticity of the digital signature, thereby confirming that the message originates from the claimed sender and has not been altered. This digital signature verification process similarly involves multiple cryptographic steps, including key generation, message signing with the private key, and verification of the signature with the public key.

[0030] In these cryptographic protocols, modular exponentiation computation is a crucial step that involves raising a number to a large exponent and then taking the modulus with respect to a large number, often a number of substantial size (e.g., 2048 bits). Due to the size of the numbers and the nature of the calculations, modular exponentiation is inherently time-consuming and resourceintensive (both computation and memory intensive), making it the most computationally demanding part of these cryptographic processes.

[0031] For instance, in the key generation phase of algorithms like RS A, two large prime numbers arc selected, and their product forms the modulus used for both the public and private keys. The generation of the public and private exponents involves finding numbers that satisfy certain mathematical properties relative to the modulus, which requires extensive computations using modular exponentiation. This step is computationally heavy because it involves operations with very large numbers to ensure the cryptographic strength of the keys, which directly impacts the security of the encryption and decryption processes.

[0032] During encryption with the public key, the sender transforms the plaintext message into ciphertext by performing modular exponentiation. Specifically, the plaintext is raised to the power of the public exponent (i.e., the public key), and the result is taken modulo the large composite number derived during key generation. This operation converts the readable message into an encrypted form that appears as a random sequence of bits to anyone without the corresponding private key. The computational intensity arises from the large exponent and modulus, requiring significant processing power and time to compute, especially for large messages or when encrypting multiple messages.

[0033] Decryption with the private key involves a similar modular exponentiation process. The receiver takes the ciphertext and raises it to the power of the private exponent (i.e., the private key), again taking the result modulo the large composite number. This operation reverses the encryption, recovering the original plaintext message.

[0034] In the context of digital signatures, message signing with the private key involves creating a signature by performing modular exponentiation on a hash of the message. The sender raises theAttorney Docket Number: 98WY-395043-WO hash value to the power of the private exponent (i.e., the private key) and takes the modulus with respect to the large number derived during key generation. This signature uniquely represents the message and the sender's private key, allowing the receiver to verify the authenticity of the message.

[0035] Verification of the signature with the public key also relies heavily on modular exponentiation. The receiver takes the signature and performs modular exponentiation using the public exponent (public key) and the same modulus. By comparing the result with the hash of the received message, the receiver can confirm whether the signature is valid. This step ensures that the message has not been altered and that it indeed comes from the claimed sender.

[0036] FIG. IB illustrates a specific cryptographic protocol within a network environment that integrates a digital wallet (digital token repository 102) on a blockchain network (blockchain network 140) and a payment card on a traditional payment card network (off-chain environment 130). The example in FIG. IB demonstrates that modular exponentiation-based cryptographic computations are employed at multiple stages of blockchain transactions.

[0037] The process involves various parties, including a user, a payment card issuing entity, the blockchain network 140, multiple online parties (120 A) executing an MPC (Multi-Party Computation) protocol, and an off-chain payment processor 112. The workflow encompasses eight key steps:

[0038] Step 1 : The user creates a digital repository 102 on the blockchain network 140, which includes a private key and a public key. This repository may be a software application on the user’s device 120 that interacts with the blockchain.

[0039] Step 2: Utilizing an MPC protocol, the private key of the digital repository 102 is split into key fragments and distributed among multiple participating devices, such as the user’ s device 120, the payment card’s chip, and online devices 120 A. This distribution enhances key security by ensuring that no single device holds the complete private key.

[0040] Step 3 : The user deposits digital currency through smart contract 104 on the blockchain network 140. The MPC protocol requires participating devices to collaboratively generate a partial signature using their key fragments, involving modular exponentiation computations for transaction authentication.

[0041] Step 4: The user makes a payment with a traditional payment card, processed through the off-chain payment network. The payment processor 112 records the transaction and triggers APIs to initiate corresponding blockchain transactions.Attorney Docket Number: 98WY-395043-WO

[0042] Step 5 : Smart contract 104 receives an API event from payment processor 112, initiating an exchange procedure to convert the digital currency into a stable second digital currency via exchange portal / platform 106.

[0043] Step 6 : The exchange portal / platform 106 interacts with a DEX aggregator to execute the exchange, employing modular exponentiation-based cryptographic computations to ensure secure and efficient transactions.

[0044] Step 7: The exchanged second digital currency is stored in a pooled repository 108, and the digital repository 102’ s balance is updated accordingly. The pooled repository 108 may transfer funds back to payment processor 112 for reimbursement.

[0045] Throughout these steps, modular exponentiation computations are integral to key generation, encryption, decryption, digital signatures, and verification processes. These computations ensure the security and integrity of transactions between the blockchain network 140 and the off-chain environment 130.

[0046] As explained above, modular exponentiation computations arc inherently computationally expensive and memory intensive, primarily due to their reliance on sequential processing and frequent memory access. Traditional modular exponentiation algorithms process the computation in a dependent sequence, where each step relies on the result of the previous one. FIG. 2 illustrates an example brute-force cryptographic process used in cryptographic communications. As shown, each step of the modular exponentiation computation relies on the result of the previous step. This sequential dependency limits the ability to execute operations in parallel, thereby increasing the total computation time required for cryptographic tasks. Additionally, these algorithms necessitate repeated access to memory for reading operands and writing intermediate results, leading to significant memory bandwidth consumption and latency, especially when dealing with large key sizes typical in modem cryptographic standards. There are some existing improvements to the brutal force solution, such as the example illustrated in FIG. 3. The exponentiation by squaring method illustrated in FIG. 3 is designed to reduce the number of operations by repeated squaring and reducing powers of the base.

[0047] While the number of iteration may be reduced by using this squaring method, the execution time for different keys (exponents) may still vary, which makes this solution vulnerable to sidechannel attacks. These attacks exploit variations in execution time, power consumption, or electromagnetic emissions to infer sensitive information, such as private keys. The inconsistent operation patterns inherent in traditional methods provide attackers with exploitable cues, compromising the security of the cryptographic protocols.Attorney Docket Number: 98WY-395043-WO

[0048] To address these challenges, the present application introduces an improved method of parallel and consistent bit- wise modular exponentiation computation. According to one aspect, this method leverages the Chinese Remainder Theorem (CRT) to decompose the modular exponentiation task into smaller, independent sub-tasks that can be processed concurrently. By enabling parallel processing, the method significantly reduces the overall computation time, enhancing the efficiency of cryptographic protocol execution.

[0049] Furthermore, the use of a consistent bit-wise processing approach, akin to the Montgomery Ladder technique, ensures that each bit of the exponent is handled uniformly, regardless of its value. This uniformity mitigates the risk of side-channel attacks by eliminating data-dependent variations in operation sequences. The method updates pairs of variables in-place within the cache, minimizing the need for frequent memory accesses and optimizing cache utilization. By aligning the computational process with hardware limitations, such as register sizes and cache hierarchies, the method ensures efficient use of available resources, reducing memory access overhead and latency.

[0050] FIG.4A illustrates a consistent bit-wise operation to accelerate modular exponentiation in a cryptographic operation with Side-Channel Attack Resistance, in accordance with some embodiments. The example process illustrated in FIG. 4A is Montgomery Ladder process for performing modular exponentiation securely and efficiently in cryptographic computations. This process iterates each bit of the exponent in a consistent manner, which not only accelerates computation but also enhances resistance to side-channel attacks.

[0051] The core idea of the Montgomery Ladder algorithm is to maintain a uniform sequence of operations for each bit of the exponent, regardless of whether the bit is a 'O' or a T. This is achieved by initializing two variables or registers serving as the starting point or "accumulator" for the calculations, denoted as R0 and R1 in FIG. 4A, while will be used to hold intermediate results during the computation.

[0052] The core of the Montgomery Ladder involves iterating through each bit of the exponent from the most significant bit (MSB) to the least significant bit (LSB). For every bit in the exponent, the process performs a series of consistent operations to ensure uniformity. If the current bit is 1, the values of R0 and R1 are updated in one way: if the bit is 0, the values of R0 and R1 are updated in another way, but with the same computation complexity. This conditional updating ensures that the sequence of operations remains the same regardless of the bit's value, which is important for maintaining security. As shown in the right part of FIG. 4A, each iteration of the Montgomery Ladder algorithm performs the same type of computation regardless of the bit value. This uniformAttorney Docket Number: 98WY-395043-WO approach ensures consistent execution times for each iteration. Consequently, as long as the cryptographic system employs a fixed bit width to represent cryptographic keys — commonly ranging from 128 bits to 4096 bits — the execution time for modular exponentiation using the Montgomery Ladder remains uniform, irrespective of the actual values of the keys.

[0053] By performing the same sequence of operations for each bit, the Montgomery Ladder process ensures that the computational process does not leak information about the exponent bits through timing variations or operation patterns. This effectively reduces the risk of side-channel attacks. Side-channel attacks exploit physical implementations of cryptographic algorithms to extract secret information based on measurable side effects, such as execution time, power consumption, or electromagnetic emissions. If an algorithm's execution path varies depending on secret data (like the bits of a private key), attackers can analyze these variations to deduce the secret information.

[0054] Additionally, the power consumption remains consistent across iterations because the same computations arc performed each time, thwarting power analysis attacks that rely on detecting differences in power consumption to extract keys.

[0055] In addition, this process is memory efficient when the intermediate results can be fit in the register or the cache associated with the processor or CPU. Because the two variables R0 and R1 are repeatedly reused and updated in each iteration, they can remain within the CPU registers or cache memory. This retention significantly reduces latency by eliminating the need to transfer these variables to the slower main memory (e.g., RAM) and retrieve them later. By keeping R0 and R1 in fast-access storage, the algorithm enhances overall performance and efficiency. By updating R0 and R1 directly within the cache or registers, the process minimizes memory access patterns that could be exploited through cache-timing attacks. Reduced memory traffic means fewer opportunities for attackers to observe and analyze memory usage patterns. Furthermore, the algorithm's design eliminates conditional operations that could introduce timing discrepancies; even the swap operations are implemented in a way that does not cause observable differences, such as using arithmetic operations or bitwise masks to perform swaps without conditional branching.

[0056] FIG. 4B illustrates a Number Theory-based process for segmenting and parallelizing modular exponentiation in a cryptographic operation, in accordance with some embodiments. While the Montgomery Ladder process depicted in FIG. 4A provides the technical advantage of consistent execution time regardless of cryptographic key values, it does not always guarantee memory efficiency. For example, if the multiplication result of R0 and R1 during an iteration becomes too large to fit within the register or cache for the modulo operation, it must be transferred to the mainAttorney Docket Number: 98WY-395043-WO memory. There, it is split into smaller words and subsequently read back into the cache or registers for further computation.

[0057] With today's cryptographic protocols utilizing larger bases and exponents, it is ideal to break down the modular exponentiation computation into smaller, independent sub-tasks using smaller (reduced) bases and / or exponents. This segmentation allows for parallel processing, ensuring memory efficiency by minimizing the need for frequent memory access. By dividing the computation into manageable segments, the system can leverage multiple processing units simultaneously, thereby accelerating the overall cryptographic operation while maintaining optimal memory usage. This approach not only enhances performance but also ensures that the cryptographic protocols remain scalable and efficient, even as the complexity and size of the keys increase.

[0058] The specific example process illustrated in FIG. 4B is Chinese Remainder Theorem (CRT) that can be used to break down a cryptographic task (specifically, the modular exponentiation step), bascexponentmod N, into smaller cryptographic sub-tasks, where % denotes the modulus operation and represents exponentiation. The first step involves reducing the exponent with respect to each prime modulus. Specifically, a is determined as the remainder when the exponent is divided by (p-1), and b is determined as the remainder when the exponent is divided by (q-1). These values a and b serve as the reduced exponents for each modulus p and q, aligning the computations with bitwidth constraints to facilitate hardware acceleration.

[0059] Next, the base is reduced relative to each modulus. The reduced base base_p is calculated as the remainder of the base when divided by p, and similarly, base_q is the remainder of the base when divided by q. These reduced bases are designed to fit within the bit-width limitations of the hardware, thereby enhancing computational efficiency. For instance, the range of the reduced base is controlled and selected such that the intermediate results (the reduced base raised to the maximum bit width of the exponent, i.e., the cryptographic key) are still less than the bit width of the CPU registers or cache.

[0060] Following these reductions, modular exponentiation is independently performed for each smaller tasks with the smaller modulus. Using base_p and a, the computation produces mod_exp_p, which represents base_p raised to the power of a modulo p. Similarly, mod_exp_q is calculated by raising base_q to the power of b modulo q. These calculations are performed in parallel, thus improving the efficiency of the process.Attorney Docket Number: 98WY-395043-WO

[0061] To combine these partial results, the modular inverse of p with respect to q is determined, denoted as inv_p. This modular inverse enables the correct alignment and merging of the results obtained from the separate computations for moduli p and q.

[0062] The final result is then computed using CRT to recombine the partial results. This is achieved by taking mod_exp_p, adding the product of p, inv_p, and the difference between mod_exp_q and mod_exp_p, and taking the outcome modulo N (where N=pxq). This produces the final value of baseexponentmod N, calculated efficiently through parallel processing and optimized memory usage, facilitated by CRT and the modular inverse.

[0063] One of the key advantages of using CRT in this context is the ability to perform these smaller computations independently and simultaneously. Modern computing systems, with their multi-core processors and parallel processing capabilities, can handle these independent tasks concurrently. This parallelization drastically reduces the overall time required to complete the modular exponentiation, as multiple smaller operations are executed at the same time rather than processing a single large operation sequentially.

[0064] FIG. 5A illustrates a comparison among various methods of performing modular exponentiation for cryptographic communications, in accordance with some embodiments. In the specific example shown in FIG. 5A, the calculation 3A13 mod 17 is used to demonstrate the number of operations required by different cryptographic methods. The table highlights that the "Parallelized Ladder" approach, which combines the Chinese Remainder Theorem (CRT) method from FIG. 4B with the Montgomery Ladder technique shown in FIG. 1A, achieves the smallest number of multiplication and modulo operations. Furthermore, the Parallelized Ladder approach enhances memory efficiency (not shown in FIG. 5A) by enabling in-place computation, meaning all calculations are performed within CPU registers or caches without the need to transfer intermediate results to main memory. This efficiency is achieved by decomposing large exponents and / or bases into smaller, independent operands that can be processed more effectively.

[0065] FIG. 5B illustrates an example flow diagram of a memory-efficient parallel processing scheme for cryptographic computation, in accordance with some embodiments.

[0066] In some embodiments, the process begins when a computing device receives a cryptographic task 510 as part of a secure communication with another device. This task may involve operations such as cryptographic key generation, transaction verification, or the creation and verification of digital signatures.

[0067] Central to this cryptographic task 510 is a modular exponentiation computation 520 that relies on a triad of operands: a base, an exponent representing a cryptographic key, and a modulus.Attorney Docket Number: 98WY-395043-WO

[0068] To enhance computational efficiency, the computing device decomposes this triad of operands into smaller parameters. Specifically, the modulus is broken down into several smaller, pairwise coprime moduli using number theory techniques 530 like the CRT illustrated in FIG. 4B. Correspondingly, the base and exponent are reduced with respect to each of these smaller moduli. This decomposition not only simplifies the calculations but also aligns the bit widths of the operands, ensuring they fit within the bit-width limits of the processing cores' registers, which is crucial for hardware acceleration.

[0069] With the operands decomposed, the computing device constructs multiple cryptographic sub-tasks 540 based on these smaller parameters. Each sub-task 540 involves a modular exponentiation using the reduced base, exponent, and modulus. The device allocates nonoverlapping memory regions in its memory 548 for each of these sub-tasks, which prevents memory contention and allows for efficient parallel processing.

[0070] In some embodiments, the sub-tasks are then processed in parallel across multiple processing cores 542, following the Montgomery Ladder solution illustrated in FIG. 4A. For each sub-task, the process initiates a pair of variables within the cache 546 or registers 544 of the core 542. 1’he computation follows a bit-by-bit iteration 550 through the reduced exponent, starting from the most significant bit and proceeding to the least significant bit. At each iteration, the pair of variables is updated based on the value of the current bit.

[0071] To further accelerate the execution of sub-tasks 540, the variables are updated in-place within the cache 546 or registers 544 without transferring intermediate values back to the main memory 548. This hardware alignment reduces memory access overhead and accelerates the computation by keeping data within the fastest accessible memory of the processing core.

[0072] Upon completing the bit-by-bit iteration 550 for a sub-task, the value of the first variable from the pair is stored as an intermediate result in the memory region associated with that sub-task. After all sub-tasks have been processed in parallel, these intermediate results are aggregated to generate the final output of the cryptographic task 560. This aggregation utilizes the properties of the CRT illustrated in FIG. 4B, allowing the reconstruction of the original modular exponentiation result from the results of the smaller computations.

[0073] Finally, based on the result 560 of the cryptographic task, the computing device generates verification data necessary for the secure communication with the other device. This could involve creating a digital signature or verifying a cryptographic key, thereby ensuring the integrity and security of the communication.Attorney Docket Number: 98WY-395043-WO

[0074] This memory-efficient parallel processing scheme in FIG. 5B offers several key advantages. By decomposing the cryptographic task into smaller, manageable sub-tasks and processing them in parallel, the scheme significantly enhances computational speed. The use of inregister or in-cache computations minimizes memory access latency, reducing overhead and improving performance. The allocation of non-overlapping memory regions ensures scalability, allowing the system to efficiently utilize available processing cores without bottlenecks. Additionally, the bit-width alignment of operands ensures that intermediate values fit within the processing cores' registers, facilitating hardware acceleration and further boosting efficiency.

[0075] FIGs. 6A-6C illustrate example applications of the memory-efficient parallel processing scheme for cryptographic computation, in accordance with some embodiments.

[0076] FIG. 6A illustrates how the memory-efficient parallel processing scheme is applied to the two essential cryptographic processes in FIG. 1A, including message encryption and decryption, and digital signature verification. FIG. 6A highlights the stages within these processes where parallelized ladder acceleration — a combination of the CRT and the Montgomery Ladder algorithm for memory-efficient computation — can be employed to enhance performance.

[0077] In the message encryption and decryption process, the parallelized ladder acceleration can be applied at several phases within this process to optimize computational efficiency. During the encryption phase, the sender encrypts the message by raising the plaintext to the power of the receiver’s public key exponent, followed by a modulo operation with the receiver’s public modulus. By leveraging the parallelized ladder acceleration, these operations can be performed in parallel with computations largely or entirely within cache, significantly accelerating the encryption process. Similarly, the receiver, in the decryption phase, decrypts the message by raising the ciphertext to the power of their private key exponent, followed by a modulo operation with their private modulus. Here, the parallelized ladder acceleration enables faster execution of these decryption tasks, reducing the time required to access the plain text. Additionally, cryptographic key generation, which involves intricate mathematical operations like large modular exponentiations, may also be accelerated using the parallelized ladder acceleration, allowing secure communication to be established more swiftly.

[0078] The digital signature verification process also includes phases where the parallelized ladder acceleration can be applied to enhance efficiency. When the sender signs the message using their private key, they must perform modular exponentiation computations, which can be timeconsuming. By using parallelized ladder acceleration, the signing process becomes more efficient,Attorney Docket Number: 98WY-395043-WO allowing the sender to generate digital signatures more quickly. Similarly, the verification process undertaken by the receiver, involving the sender’s public key, also requires modular exponentiation.

[0079] The parallelized ladder acceleration method combines the CRT and the Montgomery Ladder algorithm to achieve memory-efficient and high-performance computations. The Chinese Remainder Theorem decomposes large modular exponentiation tasks into several smaller subtasks with pairwise coprime moduli, enabling the workload to be distributed across multiple processing cores for parallel processing. This decomposition keeps intermediate values within manageable bitwidth limits, optimizing the fit within the registers or cache that are close to the processing cores. Meanwhile, the Montgomery Ladder algorithm provides a secure and efficient structure for performing modular exponentiation through a bit-by-bit iteration of the exponent. By maintaining a constant execution path, it enhances resistance to side-channel attacks.

[0080] FIG. 6B illustrates an example key generation process for creating the MPC-based digital wallet, in which the parallelized ladder acceleration can be applied to improve the performance of the secured communication. As described above, a digital wallet on a blockchain network is a software application or a service that allows users to securely store, manage, and interact with their digital assets on the blockchain. One essential component of a digital wallet is the private key of the digital wallet. A private key is a unique, randomly generated string of numbers and letters that is mathematically linked to a user's digital wallet address. It serves as a cryptographic key that enables the user to access and control their digital assets on the blockchain.

[0081] In the MPC-based key generation process depicted, three devices participate: a user device 600, a server 610, and a physical card 620. Each device stores a shard (partition) of the private key, ensuring that no single device has access to the complete key. This enhances security and fault tolerance, as less-than-all shards are required to collectively sign a blockchain transaction, allowing the system to function even if some devices fail.

[0082] The process begins when the user device 600, such as a smartphone with a digital wallet application, initiates a wallet creation request. The user device generates the private key using a cryptographic algorithm that ensures secure and random key generation. This step involves complex computations, such as generating large prime numbers and performing modular exponentiation, which are computationally intensive. By applying the parallelized ladder acceleration — which combines the CRT and the Montgomery Ladder processes — the user device can optimize these heavy computations by decomposing them into smaller subtasks processed in parallel, thus accelerating the key generation process.Attorney Docket Number: 98WY-395043-WO

[0083] After generating the private key, the user device 600 determines the number of participating devices — in this case, three — and selects a threshold number representing the minimum shards required to sign a transaction, which is less than the total number of devices to enhance robustness.

[0084] Using a secret sharing mechanism, the user device 600 divides the private key into multiple shards based on the number of devices and the threshold. This process involves cryptographic computations, including modular arithmetic and possibly modular exponentiation, to securely generate the shards. The parallelized ladder acceleration may be used to accelerate these computations by processing the mathematical operations required for each shard in parallel, speeding up the shard generation phase.

[0085] One shard is stored locally on the user device's non-volatile storage, while the other shards are distributed to the server 610 and the physical card 620. Before storage and transfer, the shards are encrypted to ensure security. Encrypting each shard involves cryptographic algorithms that utilize modular exponentiation, such as RSA encryption. Here again, the parallelized ladder acceleration can be applied to optimize the encryption processes by efficiently handling the modular exponentiation tasks involved, reducing the time required to secure each shard.

[0086] The physical card 620, equipped with a microchip such as an NFC chip, receives its shard when it taps or comes within a threshold distance of the user device 600. Communication protocols like Near Field Communication (NFC), Bluetooth, or RFID facilitate this secure transfer, and the shard is stored on the card's embedded microchip. After the transfer, the user device deletes the local copy of the shard to maintain security.

[0087] The server 610 can either generate its own shard upon receiving an instruction from the user device 600 or receive a shard generated by the user device. Secure communication between the user device and the server employs key-share communication with RSA encryption. RSA encryption and decryption are computationally intensive due to the large exponents and moduli involved in modular exponentiation operations. By applying the parallelized ladder acceleration, both the encryption (by the sender) and decryption (by the recipient) processes become more efficient, facilitating faster and more secure communication between devices.

[0088] Once all shards are distributed, the original private key is destroyed to prevent any single device from reconstmcting it independently. Transactions are signed collaboratively using the shards, requiring at least the threshold number of devices to participate. This collaborative signing process may also involve cryptographic computations that benefit from the parallelized ladder acceleration, ensuring efficient and secure transaction authorization.Attorney Docket Number: 98WY-395043-WO

[0089] Throughout the MFC wallet creation process, the steps involving heavy cryptographic computations — such as generating the private key, creating and encrypting shards, and securing communication between devices — benefit significantly from the application of the parallelized ladder acceleration. By optimizing these computations, the digital wallet achieves enhanced security, robustness, and performance in managing blockchain transactions across devices 600 (user device), 610 (server), and 620 (physical card).

[0090] FIG. 6C illustrates an example transaction signing process of the MPC-based digital wallet, in which the parallelized ladder acceleration can be applied to improve the performance of the secured communication. Still using the three-party scheme described in FIG. 6B, two out of the three distributed shards may be required to sign a blockchain transaction associated with the digital wallet. In some embodiments, the partial signatures may be generated in a distributed manner, and aggregated to the server 810 to sign the blockchain transaction.

[0091] The process begins when the mobile application on the user device 800 initiates a blockchain transaction. The user device signs the transaction using its locally stored first shard of the private key. This signing process generates a first partial signature, representing the contribution of the first shard to the overall signature. This step involves computationally intensive cryptographic operations, such as modular exponentiation and scalar multiplication. By applying the parallelized ladder acceleration — which combines CRT and the Montgomery Ladder processes — the user device can optimize these heavy computations. The modular exponentiation tasks are decomposed into smaller subtasks processed in parallel across multiple cores, enhancing both the speed and security of the signature generation.

[0092] After generating the first partial signature, the user device 800 transmits it to the server 810 to construct the full signature for the blockchain transaction. The server obtains the transaction details either from the blockchain network or directly from the user device and generates a second partial signature using the shard stored on the server. Similar to the user device, the server performs complex cryptographic computations that can benefit from the parallelized ladder acceleration. By efficiently handling the modular exponentiation operations through parallel processing and in-cache computations, the server generates its partial signature more swiftly. The two partial signatures are then combined to form the full signature required for the transaction. The aggregation of partial signatures involves cryptographic operations that can also be optimized using the parallelized ladder acceleration, ensuring efficient and secure combination of the signatures.

[0093] In some embodiments, if one of the participating devices lacks access to the blockchain network, the transaction details, or the capability to perform partial signature generation, it canAttorney Docket Number: 98WY-395043-WO indirectly participate in the signing process. For instance, if the physical card 820 does not have the computational resources to generate a partial signature, it transfers its shard to the user device 800. The user device then generates an additional partial signature on behalf of the physical card. This process adds extra computational load to the user device, which can be efficiently managed using the parallelized ladder acceleration. By processing the additional cryptographic computations in parallel, the user device can generate both partial signatures without significant delays. The user device may then transfer these partial signatures to the server 810 for aggregation. In this scenario, the server might not need to generate another partial signature, as the user device has provided sufficient signatures to authorize the blockchain transaction.

[0094] By integrating the parallelized ladder acceleration into these critical steps — generating partial signatures on the user device and server, handling additional signatures from the physical card's shard, aggregating partial signatures, and securing communications — the overall efficiency and security of the MPC-based digital wallet's transaction signing process are significantly enhanced.

[0095] FIG. 7 illustrates an example method implementing the memory-efficient parallel processing scheme for cryptographic computation, in accordance with some embodiments. In some implementations, one or more process blocks of FIG. 7 may be performed by a device.

[0096] As shown in FIG. 7, process 700 may include receiving, by a computing device, a cryptographic task as part of a secure communication with another computing device (block 710). For example, the device may receive, by a computing device, a cryptographic task as part of a secure communication with another computing device, as described above.

[0097] As also shown in FIG. 7, process 700 may include retrieving, by the computing device, a triad of operands (e.g., a set of three operands including a base, an exponent representing a cryptographic key, and a modulus) of the cryptographic task from a memory (block 720). For example, the device may retrieve, by the computing device, a triad of operands of the cryptographic task from a memory, as described above.

[0098] As further shown in FIG. 7, process 700 may include decomposing, by the computing device, the triad of operands into a plurality of smaller parameters (block 730). For example, the device may decompose, by the computing device, the triad of operands into a plurality of smaller parameters, as described above.

[0099] As also shown in FIG. 7, process 700 may include constructing, by the computing device, a plurality of cryptographic sub-tasks based on the plurality of smaller parameters (block 740). ForAttorney Docket Number: 98WY-395043-WO example, the device may construct, by the computing device, a plurality of cryptographic sub-tasks based on the plurality of smaller parameters, as described above.

[0100] As further shown in FIG. 7, process 700 may include allocating, by the computing device, a plurality of memory regions of the memory for the plurality of cryptographic sub-tasks (block 750). For example, the device may allocate, by the computing device, a plurality of memory regions of the memory for the plurality of cryptographic sub-tasks, as described above.

[0101] As also shown in FIG. 7, process 700 may include parallel processing, by the computing device, the plurality of cryptographic sub-tasks, where the parallel processing may include, for each of the plurality of cryptographic sub-tasks: initiating a pair of variables in cache; iterating bit-by- bit through one of the smaller parameters corresponding to the cryptographic sub-task, and updating the pair of variables based on each bit value; and upon completing the bit-by-bit iteration, storing the value of a first variable from the pair as an intermediate result into the memory region associated with the cryptographic sub-task (block 760). For example, the device may parallel process, by the computing device, the plurality of cryptographic sub-tasks, where the parallel processing may include, for each of the plurality of cryptographic sub-tasks: initiating a pair of variables in cache; iterating bit-by-bit through one of the smaller parameters corresponding to the cryptographic subtask, and updating the pair of variables based on each bit value; and upon completing the bit-by-bit iteration, storing the value of a first variable from the pair as an intermediate result into the memory region associated with the cryptographic sub-task, as described above.

[0102] As further shown in FIG. 7, process 700 may include upon completing the parallel processing, aggregating, by the computing device, the intermediate results from the plurality of non-overlapping memory regions as an output of the cryptographic task (block 770). For example, the device may upon completing the parallel process, aggregating, by the computing device, the intermediate results from the plurality of non-overlapping memory regions as an output of the cryptographic task, as described above.

[0103] As also shown in FIG. 7, process 700 may include generating, by the computing device based on the output of the cryptographic task, a verification data for the secure communication between the computing device and the other computing device (block 780). For example, the device may generate, by the computing device based on the output of the cryptographic task, a verification data for the secure communication between the computing device and the other computing device, as described above.

[0104] Process 700 may include additional implementations, such as any single implementation or any combination of implementations described below and / or in connection with one or moreAttorney Docket Number: 98WY-395043-WO other processes described elsewhere herein. In a first implementation, the triad of operands may include a base, an exponent representing a cryptographic key, and a modulus, and one step of the cryptographic task may include a modular exponentiation computation based on the base, the exponent, and the modulus.

[0105] In a second implementation, alone or in combination with the first implementation, the decomposing the triad of operands into a plurality of smaller parameters may include: decomposing the modulus into a plurality of smaller moduli: and reducing the base and the exponent with respect to each of the plurality of smaller moduli.

[0106] In a third implementation, alone or in combination with the first and second implementation, the base and the exponent are reduced for bit width alignment in hardware acceleration, in which a bit width of intermediate values generated based on the reduced base and the reduced exponent during the bit-by-bit iteration is less than a bit width limit of a register associated with a processing core.

[0107] In a fourth implementation, alone or in combination with one or more of the first through third implementations, the updating the pair of variables based on each bit value may include: loading the pair of variables into registers associated with the processing core from the cache: and updating the pair of variables within the registers without transferring intermediate value to the cache, thereby accelerating the cryptographic sub-task.

[0108] In a fifth implementation, alone or in combination with one or more of the first through fourth implementations, the updating the pair of variables based on each bit value may include: executing in-place updating of the pair of variables within the cache without transferring intermediate values to the memory, thereby reducing memory access overhead during the bit-by- bit iteration.

[0109] In a sixth implementation, alone or in combination with one or more of the first through fifth implementations, in the iterating bit-by-bit through one of the smaller parameters corresponding to the cryptographic sub-task, the one smaller parameter is decomposed from a cryptographic key associated with the cryptographic task, and the iterating may include: iterating bits in the smaller parameter from most significant to least significant.

[0110] In a seventh implementation, alone or in combination with one or more of the first through sixth implementations, the generating the verification data for the secure communication between the computing device and the other computing device may include: generating an encryption key for the secure communication between the computing device and the other computing device.Attorney Docket Number: 98WY-395043-WO

[0111] In an eighth implementation, alone or in combination with one or more of the first through seventh implementations, the generating the verification data for the secure communication between the computing device and the other computing device may include: generating a digital signature for the secure communication between the computing device and the other computing device.

[0112] In a ninth implementation, alone or in combination with one or more of the first through eighth implementations, the generating the verification data for the secure communication between the computing device and the other computing device may include: generating a verification result of the secure communication between the computing device and the other computing device.

[0113] In a tenth implementation, alone or in combination with one or more of the first through ninth implementations, the generating the verification data for the secure communication between the computing device and the other computing device may include: generating a blockchain transaction verification result.

[0114] In an eleventh implementation, alone or in combination with one or more of the first through tenth implementations, the generating the verification data for the secure communication between the computing device and the other computing device may include: generating a partial signature as part of Multi-Party-Computation (MPC) verification task associated with an MPC digital wallet.

[0115] In a twelfth implementation, alone or in combination with one or more of the first through eleventh implementations, the triad of operands are part of a simultaneous congruences with pairwise coprime moduli.

[0116] Although FIG. 7 shows example blocks of process 700, in some implementations, process 700 may include additional blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted in FIG. 7. Additionally, or alternatively, two or more of the blocks of process 700 may be performed in parallel.

[0117] FIG. 8 illustrates an example computing device in which any of the embodiments described herein may be implemented. The computing device 1000 may be used to implement one or more components of the systems and the methods shown in FIGs. 1-7. The computing device 1000 may comprise a bus 1002 or other communication mechanism for communicating information and one or more hardware processors 1004 coupled with bus 1002 for processing information. Hardware processor(s) 1004 may be, for example, one or more general purpose microprocessors.

[0118] The computing device 1000 may also include a main memory 1008, such as a randomaccess memory (RAM), cache and / or other dynamic storage devices, coupled to bus 1002 forAttorney Docket Number: 98WY-395043-WO storing information and instructions to be executed by processor(s) 1004. Main memory 1008 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor(s) 1004. Such instructions, when stored in storage media accessible to processor(s) 1004, may render computing device 1000 into a special-purpose machine that is customized to perform the operations specified in the instructions. Main memory 1008 may include non-volatile media and / or volatile media. Non-volatile media may include, for example, optical or magnetic disks. Volatile media may include dynamic memory. Common forms of media may include, for example, a floppy disk, a flexible disk, hard disk, solid state drive, magnetic tape, or any other magnetic data storage medium, a CD-ROM, any other optical data storage medium, any physical medium with patterns of holes, a RAM, a DRAM, a PROM, and EPROM, a FLASH- EPROM, NVRAM, any other memory chip or cartridge, or networked versions of the same.

[0119] The computing device 1000 may implement the techniques described herein using customized hard-wired logic, one or more ASICs or FPGAs, firmware and / or program logic which in combination with the computing device may cause or program computing device 1000 to be a special-purpose machine. According to one embodiment, the techniques herein are performed by computing device 1000 in response to processor(s) 1004 executing one or more sequences of one or more instructions contained in main memory 1008. Such instructions may be read into main memory 1008 from another storage medium, such as storage device 1009. Execution of the sequences of instructions contained in main memory 1008 may cause processor(s) 1004 to perform the process steps described herein. For example, the processes / methods disclosed herein may be implemented by computer program instructions stored in main memory 1008. When these instructions are executed by processor(s) 1004, they may perform the steps as shown in corresponding figures and described above. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions.

[0120] The computing device 1000 also includes a communication interface 1010 coupled to bus 1002. Communication interface 1010 may provide a two-way data communication coupling to one or more network links that are connected to one or more networks. As another example, communication interface 1010 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN (or WAN component to communicate with a WAN). Wireless links may also be implemented.

[0121] The performance of certain of the operations may be distributed among the processors, not only residing within a single machine, but deployed across a number of machines. In some example embodiments, the processors or processor-implemented engines may be located in a singleAttorney Docket Number: 98WY-395043-WO geographic location (e.g., within a home environment, an office environment, or a server farm). In other example embodiments, the processors or processor-implemented engines may be distributed across a number of geographic locations.

[0122] Each of the processes, methods, and algorithms described in the preceding sections may be embodied in, and fully or partially automated by, code modules executed by one or more computer systems or computer processors comprising computer hardware. The processes and algorithms may be implemented partially or wholly in application-specific circuitry.

[0123] When the functions disclosed herein are implemented in the form of software functional units and sold or used as independent products, they can be stored in a processor executable nonvolatile computer readable storage medium. Particular technical solutions disclosed herein (in whole or in part) or aspects that contribute to current technologies may be embodied in the form of a software product. The software product may be stored in a storage medium, comprising a number of instructions to cause a computing device (which may be a personal computer, a server, a network device, and the like) to execute all or some steps of the methods of the embodiments of the present application. The storage medium may comprise a flash drive, a portable hard drive, ROM, RAM, a magnetic disk, an optical disc, another medium operable to store program code, or any combination thereof.

[0124] Particular embodiments further provide a system comprising a processor and a non- transitory computer-readable storage medium storing instructions executable by the processor to cause the system to perform operations corresponding to steps in any method of the embodiments disclosed above. Particular embodiments further provide a non-transitory computer-readable storage medium configured with instructions executable by one or more processors to cause the one or more processors to perform operations corresponding to steps in any method of the embodiments disclosed above.

[0125] Embodiments disclosed herein may be implemented through a cloud platform, a server or a server group (hereinafter collectively the “service system”) that interacts with a client. The client may be a terminal device, or a client registered by a user at a platform, wherein the terminal device may be a mobile terminal, a personal computer (PC), and any device that may be installed with a platform application program.

[0126] The various features and processes described above may be used independently of one another or may be combined in various ways. All possible combinations and sub-combinations are intended to fall within the scope of this disclosure. In addition, certain method or process blocks may be omitted in some implementations. The methods and processes described herein are also notAttorney Docket Number: 98WY-395043-WO limited to any particular sequence, and the blocks or states relating thereto can be performed in other sequences that are appropriate. For example, described blocks or states may be performed in an order other than that specifically disclosed, or multiple blocks or states may be combined in a single block or state. The example blocks or states may be performed in serial, in parallel, or in some other manner. Blocks or states may be added to or removed from the disclosed example embodiments. The exemplary systems and components described herein may be configured differently than described. For example, elements may be added to, removed from, or rearranged compared to the disclosed example embodiments.

[0127] The various operations of exemplary methods described herein may be performed, at least partially, by an algorithm. The algorithm may be compromised in program codes or instructions stored in a memory (e.g., a non-transitory computer-readable storage medium described above). Such algorithm may comprise a machine learning algorithm. In some embodiments, a machine learning algorithm may not explicitly program computers to perform a function but can learn from training data to make a prediction model that performs the function.

[0128] The various operations of exemplary methods described herein may be performed, at least partially, by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform the relevant operations. Whether temporarily or permanently configured, such processors may constitute processor-implemented engines that operate to perform one or more operations or functions described herein.

[0129] Similarly, the methods described herein may be at least partially processor-implemented, with a particular processor or processors being an example of hardware. For example, at least some of the operations of a method may be performed by one or more processors or processor- implemented engines. Moreover, the one or more processors may also operate to support performance of the relevant operations in a “cloud computing” environment or as a “software as a service” (SaaS). For example, at least some of the operations may be performed by a group of computers (as examples of machines including processors), with these operations being accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., an Application Program Interface (API)).

[0130] The performance of certain of the operations may be distributed among the processors, not only residing within a single machine, but deployed across a number of machines. In some example embodiments, the processors or processor-implemented engines may be located in a single geographic location (e.g., within a home environment, an office environment, or a server farm). InAttorney Docket Number: 98WY-395043-WO other example embodiments, the processors or processor-implemented engines may be distributed across a number of geographic locations.

[0131] Throughout this specification, plural instances may implement components, operations, or structures described as a single instance. Although individual operations of one or more methods are illustrated and described as separate operations, one or more of the individual operations may be performed concurrently, and nothing requires that the operations be performed in the order illustrated. Structures and functionality presented as separate components in example configurations may be implemented as a combined structure or component. Similarly, structures and functionality presented as a single component may be implemented as separate components. These and other variations, modifications, additions, and improvements fall within the scope of the subject matter herein.

[0132] Although an overview of the subject matter has been described with reference to specific example embodiments, various modifications and changes may be made to these embodiments without departing from the broader scope of embodiments of the present disclosure. Such embodiments of the subject matter may be referred to herein, individually or collectively, by the term “invention” merely for convenience and without intending to voluntarily limit the scope of this application to any single disclosure or concept if more than one is, in fact, disclosed.

[0133] The embodiments illustrated herein are described in sufficient detail to enable those skilled in the art to practice the teachings disclosed. Other embodiments may be used and derived therefrom, such that structural and logical substitutions and changes may be made without departing from the scope of this disclosure. The Detailed Description, therefore, is not to be taken in a limiting sense, and the scope of various embodiments is defined only by the appended claims, along with the full range of equivalents to which such claims are entitled.

[0134] Any process descriptions, elements, or blocks in the flow diagrams described herein and / or depicted in the attached figures should be understood as potentially representing modules, segments, or portions of code which include one or more executable instructions for implementing specific logical functions or steps in the process. Alternate implementations are included within the scope of the embodiments described herein in which elements or functions may be deleted, executed out of order from that shown or discussed, including substantially concurrently or in reverse order, depending on the functionality involved, as would be understood by those skilled in the art.

[0135] As used herein, “or” is inclusive and not exclusive, unless expressly indicated otherwise or indicated otherwise by context. Therefore, herein, “A, B, or C” means “A, B, A and B, A and C, B and C, or A, B, and C,” unless expressly indicated otherwise or indicated otherwise by context.Attorney Docket Number: 98WY-395043-WOMoreover, “and" is both joint and several, unless expressly indicated otherwise or indicated otherwise by context. Therefore, herein, “A and B” means “A and B, jointly or severally," unless expressly indicated otherwise or indicated otherwise by context. Moreover, plural instances may be provided for resources, operations, or structures described herein as a single instance. Additionally, boundaries between various resources, operations, engines, and data stores are somewhat arbitrary, and particular operations are illustrated in a context of specific illustrative configurations. Other allocations of functionality are envisioned and may fall within a scope of various embodiments of the present disclosure. In general, structures and functionality presented as separate resources in the example configurations may be implemented as a combined structure or resource. Similarly, structures and functionality presented as a single resource may be implemented as separate resources. These and other variations, modifications, additions, and improvements fall within a scope of embodiments of the present disclosure as represented by the appended claims. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.

[0136] The term “include" or “comprise” is used to indicate the existence of the subsequently declared features, but it does not exclude the addition of other features. Conditional language, such as, among others, “can,” “could,” “might,” or “may,” unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain embodiments include, while other embodiments do not include, certain features, elements and / or steps. Thus, such conditional language is not generally intended to imply that features, elements and / or steps are in any way required for one or more embodiments or that one or more embodiments necessarily include logic for deciding, with or without user input or prompting, whether these features, elements and / or steps are included or are to be performed in any particular embodiment.

Claims

Attorney Docket Number: 98WY-395043-WOCLAIMSWhat is claimed is:

1. A computer-implemented method, comprising: receiving, by a computing device, a cryptographic task as part of a secure communication with another computing device; retrieving, by the computing device, a set of operands of the cryptographic task from a memory; decomposing, by the computing device, the set of operands into a plurality of parameters; constructing, by the computing device, a plurality of cryptographic sub-tasks based on the plurality of parameters; allocating, by the computing device, a plurality of memory regions of the memory for the plurality of cryptographic sub-tasks; parallel processing, by the computing device, the plurality of cryptographic sub-tasks, wherein the parallel processing comprises, for each of the plurality of cryptographic sub-tasks: initiating a pair of variables in a memory comprising at least one of a cache or a register file; iterating bit-by-bit through one of the plurality of parameters corresponding to the cryptographic sub-task, and updating the pair of variables based on each bit value; and upon completing the bit-by-bit iteration, storing the value of a first variable from the pair as an intermediate result into the memory region associated with the cryptographic sub-task; upon completing the parallel processing, aggregating, by the computing device, the intermediate results from the plurality of memory regions as an output of the cryptographic task; and generating, by the computing device based on the output of the cryptographic task, verification data for the secure communication between the computing device and the other computing device.

2. The method of claim 1, wherein the set of operands comprise a base, an exponent representing a cryptographic key, and a modulus, and one step of the cryptographic task comprises a modular exponentiation computation based on the base, the exponent, and the modulus.Attorney Docket Number: 98WY-395043-WO3. The method of claim 2, wherein the decomposing the set of operands into a plurality of parameters comprises: decomposing the modulus into a plurality of smaller moduli; and reducing the base and the exponent with respect to each of the plurality of smaller moduli.

4. The method of claim 3, wherein the base and the exponent are reduced for bit width alignment in hardware acceleration, in which a bit width of intermediate values generated based on the reduced base and the reduced exponent during the bit-by-bit iteration is less than a bit width limit of a register associated with a processing core.

5. 1’he method of claim 4, wherein the updating the pair of variables based on each bit value comprises: loading the pair of variables into registers associated with the processing core from the memory; and updating the pair of variables within the registers without transferring intermediate values to the memory, thereby accelerating the cryptographic sub-task.

6. The method of claim 1, wherein the updating the pair of variables based on each bit value comprises: executing in-place updating of the pair of variables within the memory without transferring intermediate values to the memory, thereby reducing memory access overhead during the bit-by-bit iteration.

7. The method of claim 1, wherein in the iterating bit-by-bit through one of the plurality of parameters corresponding to the cryptographic sub-task, the parameter is decomposed from a cryptographic key associated with the cryptographic task, and the iterating comprises: iterating bits in the parameter from most significant to least significant.

8. The method of claim 1, wherein the generating the verification data for the secure communication between the computing device and the other computing device comprises: generating an encryption key for the secure communication between the computing device and the other computing device.Attorney Docket Number: 98WY-395043-WO9. The method of claim 1, wherein the generating the verification data for the secure communication between the computing device and the other computing device comprises: generating a digital signature for the secure communication between the computing device and the other computing device.

10. The method of claim 1, wherein the generating the verification data for the secure communication between the computing device and the other computing device comprises: generating a verification result of the secure communication between the computing device and the other computing device.

11. The method of claim 1, wherein the generating the verification data for the secure communication between the computing device and the other computing device comprises: generating a blockchain transaction verification result.

12. The method of claim 1, wherein the generating the verification data for the secure communication between the computing device and the other computing device comprises: generating a partial signature as part of Multi-Party-Computation (MPC) verification task associated with an MPC digital wallet.

13. The method of claim 1, wherein the set of operands are part of a simultaneous congruences with pairwise coprime moduli.

14. A non-transitory computer- readable storage medium of a computing device configured with instructions executable by one or more processors to cause the one or more processors to perform operations comprising: receiving a cryptographic task as part of a secure communication with another computing device; retrieving a set of operands of the cryptographic task from a memory; decomposing the set of operands into a plurality of parameters; constructing a plurality of cryptographic sub- tasks based on the plurality of parameters; allocating a plurality of memory regions of the memory for the plurality of cryptographic sub- tasks; parallel processing the plurality of cryptographic sub-tasks, wherein the parallel processing comprises, for each of the plurality of cryptographic sub-tasks:Attorney Docket Number: 98WY-395043-WO initiating a pair of variables in a memory comprising at least one of a cache or a register file; iterating bit-by-bit through one of the plurality of parameters corresponding to the cryptographic sub-task, and updating the pair of variables based on each bit value; and upon completing the bit-by-bit iteration, storing the value of a first variable from the pair as an intermediate result into the memory region associated with the cryptographic sub-task; upon completing the parallel processing, aggregating the intermediate results from the plurality of memory regions as an output of the cryptographic task; and generating, based on the output of the cryptographic task, a verification data for the secure communication between the computing device and the other computing device.

15. The non-transitory computer- readable storage medium of claim 14, wherein the set of operands comprise a base, an exponent, and a modulus, and one step of the cryptographic task comprises a modular exponentiation computation based on the base, the exponent, and the modulus.

16. The non-transitory computer- readable storage medium of claim 15, wherein the decomposing the set of operands into a plurality of parameters comprises: decomposing the modulus into a plurality of smaller coprime moduli; and reducing the base and the exponent with respect to each of the plurality of smaller moduli.

17. The non-transitory computer- readable storage medium of claim 16, wherein the base and the exponent are reduced for bit width alignment in hardware acceleration, in which a bit width of intermediate values generated based on the reduced base and the reduced exponent during the bit-by-bit iteration is less than a bit width limit of a register associated with a processing core.

18. The non-transitory computer- readable storage medium of claim 17, wherein the updating the pair of variables based on each bit value comprises: loading the pair of variables into registers associated with the processing core from the memory; and updating the pair of variables within the registers without transferring intermediate value to the memory, thereby accelerating the cryptographic sub-task.Attorney Docket Number: 98WY-395043-WO19. A system comprising one or more processors and one or more non-transitory computer-readable memories coupled to the one or more processors and configured with instructions executable by the one or more processors to cause the system to perform operations comprising: receiving a cryptographic task as part of a secure communication with another system; retrieving a set of operands of the cryptographic task from a memory; decomposing the set of operands into a plurality of parameters; constructing a plurality of cryptographic sub-tasks based on the plurality of parameters; allocating a plurality of memory regions of the memory for the plurality of cryptographic sub- tasks; parallel processing the plurality of cryptographic sub-tasks, wherein the parallel processing comprises, for each of the plurality of cryptographic sub-tasks: initiating a pair of variables in a memory comprising at least one of a cache or a register file; iterating bit-by-bit through one of the plurality of parameters corresponding to the cryptographic sub-task, and updating the pair of variables based on each bit value; and upon completing the bit-by-bit iteration, storing the value of a first variable from the pair as an intermediate result into the memory region associated with the cryptographic sub-task; upon completing the parallel processing, aggregating the intermediate results from the plurality of memory regions as an output of the cryptographic task; and generating, based on the output of the cryptographic task, a verification data for the secure communication between the system and the other system.

20. The system of claim 19, wherein in the iterating bit-by-bit through one of the plurality of parameters corresponding to the cryptographic sub-task, the one parameter is decomposed from a cryptographic key associated with the cryptographic task, and the iterating comprises: iterating bits in the parameter from most significant to least significant.

Images