I’m looking for a one-way accumulator which can safely add new members (deletion is not necessary) and does not rely on a trusted party in any way. Unfortunately it appears that it does not exist yet.

My project has an authentication based on a block chain (like Bitcoin) so it's manually initialized and after that it runs on its own. If I put a hash in every block, nodes relay special packets only for the authenticated users, hence the need for a simple authentication scheme without a group manager, no one is to be trusted more than yourself in his honesty. After a round of votes all the nodes agree on the entrance of a new member and the hash is changed accordingly (or witnesses depending on the scheme) and the ban of a member is simply another "black list" hash (or some other method depending on the scheme).

  • 1
    $\begingroup$ Did you try Google @gurghet? Yes, there are. There are three existing schemes that immediately come to my mind. Two of them can even be made universal (non-membership witnesses). The question as it is is a pure reference request and off topic. If you have more concrete questions to an accumulator scheme, edit your question and I'll answer. $\endgroup$ – DrLecter Mar 19 '14 at 7:04
  • 1
    $\begingroup$ This one for instance @gurghet? $\endgroup$ – DrLecter Mar 19 '14 at 9:50
  • 1
    $\begingroup$ Just for the setup. But in a real world setting you will need soneone who runs the setup in any scheme @gurghet. Maybe you could edit your question and outline your application. Otherwise this seems to be a crystal ball thing ;) $\endgroup$ – DrLecter Mar 19 '14 at 9:57
  • 1
    $\begingroup$ If you only want to add elements to the accumulator, then you can forget the factorization after setup @gurghet. However, if you want collision-freeness you can only accumulate prime numbers. But you can use the mapping to primes proposed in Appendix B of this paper for this purpose and thus accumulate arbitrary elements which you map to primes. $\endgroup$ – DrLecter Mar 19 '14 at 10:22
  • 2
    $\begingroup$ @DrLecter You still need a trusted party who promises to forget the factorization. While you can generate RSA moduli without knowing their factorization they're very big. $\endgroup$ – CodesInChaos Mar 19 '14 at 10:55