Can I publish the accumulator trapdoor and still keep it secure?

Question

I'm implementing the Camenish-Lysyanskaya dynamic accumulator. It seems to me that the accumulator is provably secure because the trapdoor is unknown to the attacker.

The risks should be the fact that, given the Euler theorem, I can forge an element that is was not accumulated but still passes the test, namely:

$v^x\equiv v^{x\mod\phi}\mod n$

where $v$ is the accumulator without $x$, $\phi$ is the Euler function, and

$x\mod\phi\equiv x_f$

so we have a forged $x$ that passes the test.

What if I don't care about the factorization of n and I even publish $\phi$, but I just require that an acceptable integer $x_{acc}$ must be $A<x_{acc}<A+\phi$ with $A<\phi$.

This means that if, for example my input is the string "user1" this string will be hashed into an integer in the accepted interval.

If $\phi$ is large enough, I still can defy collisions and stop caring about keeping $\phi$ secret. All the possibly forged inputs fall automatically out of the specified interval so they will be discarded immediately. In other words there is no valid integer congruent to integer that maps the input "user1"

What do you think? Is this feasible? Or am I missing something obvious? I understand I may have skipped something important, I am not in the field, please ask for clarifications.

Answer 1

I guess you are missing something.

If you know that the accumulator value is $a=v^{\prod_i x_i} \bmod n$ to a set of values $x_i$ and you know the factorization of $n$, then it is easy to for any arbitrary $y$ relatively prime to $n$ (in RSA accumulators you accumulate primes) a value $k$ such that $y\cdot k \equiv 1 \pmod{\varphi(n)}$ as the value $\varphi(n)$ is public. So anyone can pretend that any arbitrary value $y$ has been accumulated using $a^k$ as the membership witness and note that the verification $a\equiv (a^k)^y \bmod n$ holds. I guess that you would not like to have that "feature".

So either you make the factorization not public (use a trusted setup) or if this is not possible you can go with trapdoor free RSA accumulators (basically by computing an RSA modulus in a way that the factorization is unknown to anybody).