GMR Quadratic Accumulators

A Goldwasser-Micali commitment c = x * r (mod N) commits to x, where r is a random quadratic residue. The witness z = x * e * r where e = H(a,c), with the prover publishing (a, c, z) proves that a is a quadratic residue, and the prover knows x, verified as z^2 ≡ a * e^2 * c (mod n).

GM commitments are binding and hiding. Goldwasser-Micali-Rivest (GMR) proofs are complete, sound, and zero-knowledge.