Advances in Cryptology — CRYPTO 2002

Volume 2442 of the series Lecture Notes in Computer Science pp 61-76


Dynamic Accumulators and Application to Efficient Revocation of Anonymous Credentials

  • Jan CamenischAffiliated withZurich Research Laboratory, IBM Research
  • , Anna LysyanskayaAffiliated withMIT LCS


We introduce the notion of a dynamic accumulator. An accumulator scheme allows one to hash a large set of inputs into one short value, such that there is a short proof that a given input was incorporated into this value. A dynamic accumulator allows one to dynamically add and delete a value, such that the cost of an add or delete is independent of the number of accumulated values. We provide a construction of a dynamic accumulator and an efficient zero-knowledge proof of knowledge of an accumulated value. We prove their security under the strong RSA assumption. We then show that our construction of dynamic accumulators enables efficient revocation of anonymous credentials, and membership revocation for recent group signature and identity escrow schemes.


Dynamic accumulators anonymity certificate revocation group signatures credential systems identity escrow