4

A paper (http://ieeexplore.ieee.org/abstract/document/7961987/) proposes a Braavos (adaptively sound dynamic positive accumulator).

Braavos uses two other accumulators. One is adaptively sound positive additive accumulator $ACC_A$ and the other is an non-adaptively sound positive dynamic accumulator $ACC_{NA}$.

In the paper, the authors says that they uses Camenisch-Lysyanskaya (CL) signatures (http://dl.acm.org/citation.cfm?id=1766811.1766838) as $ACC_A$.

I cannot understand how CL signature can be adopted as $ACC_A$.

$ACC_A$ requires {Gen, Add, Del, MemWitUpOnAdd, VerifyMem} protocols, but in the CL protocol they does not exist. {only Gen, Sign, and Verify}

My goal is to implement Idemix with Braavos (same as the paper).

Does anyone can let me know how can I implement $ACC_A$ using CL signature.

takita
  • 509
  • 2
  • 8

1 Answers1

2

Any signature scheme can work as an accumulator: when elements are signed with the manager's secret key, signature works as a system membership witness (positive acc). It is also additive because you can only add elements in the system by signing them, you cannot cancel a signature in the future (to delete them).

io_k
  • 36
  • 5