# Is there an efficient way to verify the union of two RSA accumulators?

More specifically, say we have one RSA accumulator $A_{S_1}$ accumulating set $S_1$ and another RSA accumulator $A_{S_2}$ accumulating set $S_2$. Does there exist a sublinear method to securely verify that another RSA accumulator $B$ accumulates the set $S_1 \cup S_2$, given only $A_{S_1}$ and $A_{S_2}$? All accumulators would be modulo the same $N$.

I suspect that billinear maps over composite groups may be enough, but I am not sure if building an RSA accumulator over one of these groups breaks its security.

For a definition of the RSA accumulator, refer to section 2.2 of this paper: https://eprint.iacr.org/2009/625.pdf.

• You might want to add the definition of the accumulator. They are not widely used, and I don't know if there is a standard construction. – tylo Aug 22 '17 at 8:35
• Done! The RSA accumulator is fairly obscure, so hopefully the definition will help. – vb7401 Aug 22 '17 at 15:18
• If $A_{S_1}$ and $A_{S_2}$ are disjoint and $B$ is given as a superset of either $A_{S_1}$ or $A_{S_2}$, then yes. Have a look at look at this 2018 paper in section Accumulator unions on page 22 – lovesh Jan 7 at 7:59