compiled into a public evaluation and verification keys: unfortunately, it isn’t scalable to millions of users and/or the large circuits/constraints required to cover all the typologies of national identity cards/ePassports, thus an implementation based on TEE and mutual attestation is the preferred implementation \[sub:Detailed-Authentication-Protocol-Remote-Attestation\]. The only zero-knowledge proof system that could be scalable enough[@cryptoeprint:2018:691] works on a computer cluster, thus it doesn’t fit the setting of a single user authenticating on his own device, and a libsnark backend can’t handle more than 4 million gates requiring more than an hour of computation. Therefore, an implementation only using software means is still Work-In-Progress.

Cryptographic Accumulators
--------------------------

Firstly devised by Benaloh and de Mare[@10.1007/3-540-48285-7_24], a cryptographic accumulator [@cryptoeprint:2015:087] is a compact binding set of elements supporting proofs of membership and more space-efficient than storing all of the elements of the set; given an accumulator, an element, and a membership witness, the element’s presence in the accumulated set can be verified. Generally speaking, an accumulator consists of four polynomial-time algorithms:

-   $Generate\left(1^{k}\right)$: given the security parameter $k$, it instantiates the initial value of the empty accumulator.

-   $Add\left(a,y\right)\rightarrow\left(a',w\right)$: adds the element $y$ to the current state of the accumulator $a$ producing the updated 