Strong accumulators from collision-resistant hashing

Abstract

Accumulator schemes were introduced in order to represent a large set of values as one short value called the accumulator. These schemes allow one to generate membership proofs, that is, short witnesses that a certain value belongs to the set. In universal accumulator schemes, efficient proofs of non-membership can also be created. Li et al. (Proceedings of applied cryptography and network security--ACNS '07, LNCS, vol 4521, 2007), building on the work of Camenisch and Lysyanskaya (Advances in cryptology--proceedings of Crypto '02, LNCS, vol 2442. Springer, Berlin, pp 61---76, 2002), proposed an efficient accumulator scheme, which relies on a trusted accumulator manager. Specifically, a manager that correctly performs accumulator updates. In this work, we introduce the notion of strong universal accumulator schemes, which are similar in functionality to universal accumulator schemes, but do not assume the accumulator manager is trusted. We also formalize the security requirements for such schemes. We then give a simple construction of a strong universal accumulator scheme, which is provably secure under the assumption that collision-resistant hash functions exist. The weaker requirement on the accumulator manager comes at a price; our scheme is less efficient than known universal accumulator schemes--the size of (non)membership witnesses is logarithmic in the size of the accumulated set in contrast to constant in the scheme of Camenisch and Lysyanskaya. Finally, we show how to use strong universal accumulators to solve a problem of practical relevance, the so-called e-Invoice Factoring Problem.