More specifically, say we have one RSA accumulator $A_{S_1}$ accumulating set $S_1$ and another RSA accumulator $A_{S_2}$ accumulating set $S_2$. Does there exist a sublinear method to securely verify that another RSA accumulator $B$ accumulates the set $S_1 \cup S_2$, given only $A_{S_1}$ and $A_{S_2}$? All accumulators would be modulo the same $N$.

I suspect that billinear maps over composite groups may be enough, but I am not sure if building an RSA accumulator over one of these groups breaks its security.

For a definition of the RSA accumulator, refer to section 2.2 of this paper: https://eprint.iacr.org/2009/625.pdf.

  • 1
    $\begingroup$ You might want to add the definition of the accumulator. They are not widely used, and I don't know if there is a standard construction. $\endgroup$ – tylo Aug 22 '17 at 8:35
  • $\begingroup$ Done! The RSA accumulator is fairly obscure, so hopefully the definition will help. $\endgroup$ – vb7401 Aug 22 '17 at 15:18
  • $\begingroup$ If $A_{S_1}$ and $A_{S_2}$ are disjoint and $B$ is given as a superset of either $A_{S_1}$ or $A_{S_2}$, then yes. Have a look at look at this 2018 paper in section Accumulator unions on page 22 $\endgroup$ – lovesh Jan 7 at 7:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.