## 4 Preliminaries
### Incrementally Aggregatable Subvector Commitments  
Here, we give an implementation of incrementally aggregatable subvector commitments based on the RSA assumption within groups of unknown order. Incremental aggregatable subvectors commit to having parameters of constant size, unrelated to the vector length, and similarly, the verification time is constant. In order for the scheme to have constant-sized parameters, the prover is made to calculate \(S_{i}\) and incorporate it in the opening at position \(i\). To prevent the adversary from generating the wrong \(S_{i}\), we store the public parameter \(U_{n}=g^{\Gamma\mathbb{I}_{c\in[n]}\cdot e_{i}}\) as an accumulator over all positions. The prover can correctly verify that \(S_{i}\) passes through \(S_{i}^{\epsilon_{n}}=U_{n}\) as an accumulator over all positions. The prover can correctly verify that \(S_{i}\) passes through \(S_{i}^{\epsilon_{n}}=U_{n}\) in a constant time. The incrementally aggregatable subvector commitment defined here consists of the following algorithm: \((VC.Setup,VC.Specialize,VC.Com,VC.Open,VC.Verify,VC.Disagg,VC.Agg)\). The setup algorithm \(VC.Setup(1^{\lambda},1,n)\to crs\) produces a group of hidden order \(G\gets Ggen(1^{\lambda})\), a generator \(g\leftarrow\mathcal{R}\)\(G\). Furthermore, it defines a deterministic collision function, \(PrimeGen\), which maps integers to prime numbers. \(VC.Specialize(crs,n)\rightarrow\tau s_{n}\): the specialize algorithm calculates \(n(l+1)\)-bit primes \(e_{1},\ldots,e_{n},\)\(e_{i}\leftarrow PrimeGen(i)\) through \(PrimeGen\) algorithm, where \(i\in[n],U_{n}=g^{e_{[n]}}\), returns \(\tau s_{n}\leftarrow(crs,U_{n})\). \(U_{n}\)can be designated as an accumulator for the set \([n]\). \(VC.Com(crs,\vec{v})\rightarrow(C,aux)\): the commitment algorithm computes \(S_{i}\gets g^{e_{[n]}(i)}\) for all \(i\in[n],C\gets S_{1}^{v_{1}}\ldots S_{n}^{v_{n}}\) and \(aux\leftarrow(v_{1},\ldots,v_{n})\). \(VC.Open(crs,I,\vec{y},aux)\rightarrow\pi_{\Gamma}\): the open algorithm generates for each \(j\in[n]\setminus I,S_{j}^{1/\epsilon_{\Gamma}}\gets g^{e_{[n]}(i\cup(i))}\) and \(S_{I}\gets g^{e_{[n]}}\) and then returns \(\pi_{I}:=(S_{I},A_{I})\);  
\[\Lambda_{I}\leftarrow\prod_{j=1,j\
otin I}^{n}\left(S_{j}^{1/\epsilon_{\Gamma} }\right)^{y_{j}}=\left(\prod_{j=1,j\
otin I}^{n}S_{j}^{y_{j}}\right)^{1/ \epsilon_{\Gamma}} \tag{1}\]  
\(VC.Verify(crs,C,I,\vec{y},\pi_{I})\to b\in\{0,1\}\): the verify algorithm parse \(\pi_{I}:=(S_{I},A_{I})\), and computes for all \(i\in I,S_{i}=S_{j}^{e_{\Gamma}(i)}=U_{n}^{1/\epsilon_{\Gamma}}\). Computing the following equation returns 1 if it holds, and 0 if not. \[S_{I}^{\epsilon_{\Gamma}}=U_{n}\wedge C=\Lambda_{I}^{\epsilon_{\Gamma}}\prod_{ i\in I}S_{i}^{y_{i}} \tag{2}\]  
\(VC.Disagg(crs,I,\overrightarrow{v_{I}},\pi_{I},K)\rightarrow\pi_{K}\): the disaggregation algorithm parse \(\pi_{I}:=(S_{I},A_{I})\), firstly. Then computes \(S_{K}\) from \(S_{I},S_{K}\gets S_{I}^{\epsilon_{K}}\), for each \(j\in I\setminus K\), calculate \(X_{j}=S_{K}^{1/\epsilon_{j}}\), by computing \(X_{j}=S_{I}^{e_{[n]}(j)}\). Finally, it returns the proof \(\pi_{K}:=(S_{K},\Lambda_{K})\), where \[\Lambda_{K}\leftarrow\Lambda_{I}^{e_{I}\setminus K}\cdot\prod_{i\in I\setminus K}X_{j }^{v_{j}} \tag{3}\]  
\(VC.Agg(crs,(I,\overrightarrow{v}_{I},\pi_{I}),(I,\overrightarrow{v}_{I},\pi_{J})) \rightarrow\pi_{K}\): the aggregation algorithm parse \(\pi_{I}:=(S_{I},\Lambda_{I})\), and similarly \(\pi_{I}:=(S_{J},\Lambda_{I})\). let \(K=I\cup J\), \(I\cap J=\varnothing\). First, compute \(S_{K}\leftarrow\mathit{ShamirTrick}(S_{I},S_{J})\). Then, for every \(j\in J\), computes \(\phi_{j}\gets S_{K}^{e_{I}\setminus(j)}=S_{I}^{1/e_{j}}\), and \(\psi_{i}\gets S_{K}^{e_{I}\setminus(i)}=S_{J}^{1/e_{j}}\).