accumulator value $a'$ and the membership witness $w$ for $y$.

-   $WitnessAdd\left(w,y\right)\rightarrow w'$: on the basis of the current state of a witness $w$ and the newly added value $y$, it returns an updated witness $w'$.

-   $Verify\left(a,y,w\right)\rightarrow\left\{ true,false\right\} $: verifies the membership of $y$ using its witness $w$ on the current state of accumulator $a$.

The following are interesting security properties of accumulators:

-   Dynamic accumulators[@10.1007/3-540-45708-9_5]: accumulators supporting the removal of elements from the accumulator by means of a deletion algorithm $Removal()$ and a witness update algorithm $WitnessRemoval\left(\right)$.

-   Universality[@10.1007/978-3-540-72738-5_17]: accumulators supporting non-membership proofs, $NonWitnessAdd\left(\right)$, $NonWitnessRemoval\left(\right)$ and $NonVerify\left(\right)$.

-   Strong accumulators[@Camacho2012]: deterministic and publicly executable, meaning that it does not rely on a trusted accumulator manager.

-   Public checkable accumulators, the correctness of every operation can be publicly verified.

Recent constructions of cryptographic accumulators specifically tailored for blockchains are: a dynamic, universal, strong and publicly checkable accumulator [@certcoin]; an asynchronous accumulator[@cryptoeprint:2015:718] with low frequency update and old-accumulator compatibility (i.e., up-to-date witnesses can be verified even against an outdated accumulator); a constant-sized, fair, public-state, additive, universal accumulator[@cryptoeprint:2018:853], and an accumulator optimised for batch and aggregation operations[@cryptoeprint:2018:1188].

Remote Attestation
------------------

In the terminology of Intel SGX, remote attestation is used to 