Is it possible to translate the RSA accumulator scheme directly to EC without requiring bilinear pairings?

In RSA we have:

$A_{n+1} = A_n^c$ st. $\{c \: \textrm{prime} \: | \: c \in [\mathcal{A}, \mathcal{B}]\}$

$W = A_n$

$A_{n+1} \stackrel{?}{=} W^c $

Would this work in EC like this?

$A_{n+1} = c A_n$

$W = A_n$

$A_{n+1} \stackrel{?}{=} c W $

Where $A_0$ is a generator point on the curve and $c$ is prime.

If not, then why?


1 Answer 1


OK posting my own answer, not sure if this is correct, but:

The RSA accumulator scheme relies on the lack of knowledge of the totient function, which is used for computing inverse powers.

The EC scheme doesn't have this restriction so you're able to prove any value is a member of the set simply by computing its inverse.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.