<ul>
<li>RSA accumulators are far harder to implement correctly</li>
<li>RSA accumulators need a trusted setup (someone, or multiple someones, must come up with a sufficiently large integer that is the product of 2 primes, and then throw those individual primes away). Bitcoin is generally designed to avoid trusted parties.</li>
<li>For a 128-bit security level, you need at least 3000 bits RSA moduli, meaning that a proof would be 3000 bits. That's only a win compared to Merkle paths for trees with more than 12 levels, which in the case of transactions in blocks, means over 4096 transaction. That isn't usually the case, and even when it is, it is only barely so.</li>
</ul>

CC BY-SA 4.0
2024-10-06T02:32:56.113Z
how about now? Now there are quite a lot improvements in the applications of RSA accumulators in ZK: https://eprint.iacr.org/2024/395.pdf, https://eprint.iacr.org/2021/1672.pdf, https://eprint.iacr.org/2021/1672. Should RSA accumulators be considered?
Eric_Qin
CC BY-SA 4.0
2019-12-28T17:25:31.987Z
2019-12-28T19:08:20.277Z
2019-12-28T19:08:20.277Z
Pieter Wuille
<p>For proof of inclusion (used by SPV nodes) Bitcoin relies on Merkle proofs.
Why Merkle trees were chosen and not RSA accumulators, as they can be used to provide a shorter proof?</p>

<p>What are the advantages/disadvantages of RSA accumulators vs. Merkle proof?</p>

<merkle-tree><spv>
RSA accumulator vs Merkle Proofs
whomaniac
# RSA accumulator vs Merkle Proofs

(Asked by: username_0 on 2019-12-28)

For proof of inclusion (used by SPV nodes) Bitcoin relies on Merkle proofs.
Why Merkle trees were chosen and not RSA accumulators, as they can be used to provide a shorter proof?

What are the advantages/disadvantages of RSA accumulators vs. Merkle proof?

**Tags:** merkle-tree, spv


---

## 1 answers

### Answer by username_1 on 2019-12-28. Score: 5 | Accepted answer

* RSA accumulators are far harder to implement correctly
* RSA accumulators need a trusted setup (someone, or multiple someones, must come up with a sufficiently large integer that is the product of 2 primes, and then throw those individual primes away). Bitcoin is generally designed to avoid trusted parties.
* For a 128-bit security level, you need at least 3000 bits RSA moduli, meaning that a proof would be 3000 bits. That's only a win compared to Merkle paths for trees with more than 12 levels, which in the case of transactions in blocks, means over 4096 transaction. That isn't usually the case, and even when it is, it is only barely so.

> **Comments:**
> **username_2**: how about now? Now there are quite a lot improvements in the applications of RSA accumulators in ZK: https://eprint.iacr.org/2024/395.pdf, https://eprint.iacr.org/2021/1672.pdf, https://eprint.iacr.org/2021/1672. Should RSA accumulators be considered?  

---

