A cryptographic accumulator is a one way membership function. It answers a query as to whether a potential candidate is a member of a set without revealing the individual members of the set.

A cryptographic accumulator is a commitment to a set of elements. Accumulators support proofs of (non)membership, sometimes in zero-knowledge, revealing no information about other elements in the set.

The first accumulator construction by Benaloh and de Mare [1] was based on the Strong RSA assumption. Nguyen later introduced a pairing-based accumulator [2]. While these two constructions are used most often in the literature, many others exist. For example, non-algebraic constructions such as Merkle trees are also considered to be accumulators, although (non)membership proofs in Merkle trees are logarithmic-sized, rather than constant-sized.


  1. "One-way accumulators: a decentralized alternative to digital signatures" by J. Benaloh and M. de Mare (1993)
  2. "Accumulators from Bilinear Pairings and Applications to ID-based Ring Signatures and Group Membership Revocation" by Lan Nguyen (2005)