Accumulators, based on bilinear map (pairings) and without them

vb_accumulator

Dynamic Positive and Universal accumulators according to the paper: Dynamic Universal Accumulator with Batch Update over Bilinear Groups

Implements

• a dynamic positive accumulator PositiveAccumulator, that supports membership proofs.
• a dynamic universal accumulator UniversalAccumulator, that supports membership and non-membership proofs.
• a zero knowledge proof of membership and non-membership in the accumulators with ProofProtocol as described in the paper. These are essentially proofs of knowledge of a weak-BB signature
• an alternate and more efficient protocol of zero knowledge proof of membership and non-membership based on a more efficient protocol for proving knowledge of a weak-BB signature. This isn't described in the paper.
• keyed verification proofs of membership and non-membership where the verifier knows the secret key. Such accumulator don't need pairings

Allows

• single and batch updates (additions, removals or both) to the accumulators.
• single and batch updates to the witness.

Both accumulators implement that trait Accumulator that contains the common functionality. Both MembershipWitness and NonMembershipWitness can be updated either using secret key or using public info published by accumulator manager called Omega. Most of the update logic is in the trait Witness which is implemented by both MembershipWitness and NonMembershipWitness. The implementation tries to use the same variable names as the paper and thus violate Rust's naming conventions at places.

kb_accumulator

Dynamic Positive and Universal accumulators according to the paper: Efficient Constructions of Pairing Based Accumulators

Implements

• a dynamic positive accumulator KBPositiveAccumulator, that supports membership proofs. Based on construction 2 in the paper.
• a dynamic universal accumulator KBUniversalAccumulator, that supports membership and non-membership proofs. Based on construction 3 in the paper
• zero knowledge proofs of membership and non-membership in the accumulators. These are essentially proofs of knowledge of a BB signature and weak-BB signature.
• an alternate and more efficient protocol for membership and non-membership proofs
• keyed verification proofs of membership and non-membership where the verifier knows the secret key. Such accumulator don't need pairings

Allows batch updates to the accumulator and the witness using the techniques from vb_accumulator

The implementation uses type-3 pairings compared to type-1 in the paper.