Universally composable accumulators

Foteini Badimtsi, Ran Canetti, Sophia Yakoubov*

*Corresponding author for this work

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

Abstract

Accumulators, first introduced by Benaloh and de Mare (Eurocrypt 1993), are compact representations of arbitrarily large sets and can be used to prove claims of membership or non-membership about the underlying set. They are almost exclusively used as building blocks in real-world complex systems, including anonymous credentials, group signatures and, more recently, anonymous cryptocurrencies. Having rigorous security analysis for such systems is crucial for their adoption and safe use in the real world, but it can turn out to be extremely challenging given their complexity. In this work, we provide the first universally composable (UC) treatment of cryptographic accumulators. There are many different types of accumulators: some support additions, some support deletions and some support both; and, orthogonally, some support proofs of membership, some support proofs of non-membership, and some support both. Additionally, some accumulators support public verifiability of set operations, and some do not. Our UC definition covers all of these types of accumulators concisely in a single functionality, and captures the two basic security properties of accumulators: correctness and soundness. We then prove the equivalence of our UC definition to standard accumulator definitions. This implies that existing popular accumulator schemes, such as the RSA accumulator, already meet our UC definition, and that the security proofs of existing systems that leverage such accumulators can be significantly simplified. Finally, we use our UC definition to get simple proofs of security. We build an accumulator in a modular way out of two weaker accumulators (in the style of Baldimtsi et al. (Euro S&P 2017), and we give a simple proof of its UC security. We also show how to simplify the proofs of security of complex systems such as anonymous credentials. Specifically, we show how to extend an anonymous credential system to support revocation by utilizing our results on UC accumulators.

Original languageEnglish
Title of host publicationTopics in Cryptology – CT-RSA 2020 - The Cryptographers Track at the RSA Conference 2020, Proceedings
EditorsStanislaw Jarecki
PublisherSpringer
Pages638-666
Number of pages29
ISBN (Print)9783030401856
DOIs
StatePublished - 2020
Externally publishedYes
EventCryptographers Track at the RSA Conference, CT-RSA 2020 - San Francisco, United States
Duration: 24 Feb 202028 Feb 2020

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume12006 LNCS
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Conference

ConferenceCryptographers Track at the RSA Conference, CT-RSA 2020
Country/TerritoryUnited States
CitySan Francisco
Period24/02/2028/02/20

Funding

FundersFunder number
National Science Foundation1717067
Horizon 2020 Framework Programme669255

    Fingerprint

    Dive into the research topics of 'Universally composable accumulators'. Together they form a unique fingerprint.

    Cite this