# Does pairings based cryptography inherently require a CRS/trusted setup?

In all algorithms I've seen that rely on pairings-based cryptography (some examples: snarks without PCPs, more snarks, sublinear ring signatures), a common reference string is required. Is this always the case? If so, what is it about pairings (or the algorithms that use them?) that means the CRS is needed?

I know ZCash got around this by using MPC to emulate a TTP as described here, here, and here, but I'm more interested in understanding why the CRS is necessary. To clarify, I don't mean why the party that generates it needs to be trusted, as I understand that the public parameters of the CRS cannot be generated without use of the 'private' component that must later be destroyed, but I would like to know why the public parameters are required?

(I've looked at is pairing based crypto ready for productive use thinking it might answer this question but it doesn't)

• the Bünz–Maller–Mishra–Vesely polynomial commitment scheme. (This could in principle be used for NIZK arguments of knowledge, although it has $$\Theta(\sqrt{N})$$ verification and so is not fully succinct.)