4
$\begingroup$

A paper (http://ieeexplore.ieee.org/abstract/document/7961987/) proposes a Braavos (adaptively sound dynamic positive accumulator).

Braavos uses two other accumulators. One is adaptively sound positive additive accumulator $ACC_A$ and the other is an non-adaptively sound positive dynamic accumulator $ACC_{NA}$.

In the paper, the authors says that they uses Camenisch-Lysyanskaya (CL) signatures (http://dl.acm.org/citation.cfm?id=1766811.1766838) as $ACC_A$.

I cannot understand how CL signature can be adopted as $ACC_A$.

$ACC_A$ requires {Gen, Add, Del, MemWitUpOnAdd, VerifyMem} protocols, but in the CL protocol they does not exist. {only Gen, Sign, and Verify}

My goal is to implement Idemix with Braavos (same as the paper).

Does anyone can let me know how can I implement $ACC_A$ using CL signature.

Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

Any signature scheme can work as an accumulator: when elements are signed with the manager's secret key, signature works as a system membership witness (positive acc). It is also additive because you can only add elements in the system by signing them, you cannot cancel a signature in the future (to delete them).

Improve this answer
$\endgroup$
3
  • $\begingroup$ Thanks for your reply. But does a signature represent only one element? How it accumulates 'multiple elements' into one value? $\endgroup$
    – takita
    Feb 14, 2019 at 4:07
  • 1
    $\begingroup$ correct! It doesn't accumulate, you can just consider the set of all signed elements as a positive additive accumulator. Proof of membership equals signature verification. If you are referring to accumulator size=1 of Fig.10 (signatures column), I think it just means that you don't need to store anything else than the public key to verify a proof membership. If you ever want to remove a member from the set, you need a second accumulator to add the deleted elements there (this makes it dynamic). $\endgroup$
    – Ioanna
    Feb 15, 2019 at 1:34
  • 1
    $\begingroup$ or add the still valid ones, depends on the implementation (Braavos or BraavosB-Appendix) $\endgroup$
    – Ioanna
    Feb 15, 2019 at 1:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.