Does pairings based cryptography inherently require a CRS/trusted setup?

Question

In all algorithms I've seen that rely on pairings-based cryptography (some examples: snarks without PCPs, more snarks, sublinear ring signatures), a common reference string is required. Is this always the case? If so, what is it about pairings (or the algorithms that use them?) that means the CRS is needed?

I know ZCash got around this by using MPC to emulate a TTP as described here, here, and here, but I'm more interested in understanding why the CRS is necessary. To clarify, I don't mean why the party that generates it needs to be trusted, as I understand that the public parameters of the CRS cannot be generated without use of the 'private' component that must later be destroyed, but I would like to know why the public parameters are required?

(I've looked at is pairing based crypto ready for productive use thinking it might answer this question but it doesn't)

Answer 1

No. For example, these pairing-based protocols don't require trusted setup:

• BLS signatures;
• tripartite Diffie-Hellman, as mentioned in Elias' answer;
• some identity-based encryption schemes (when users are their own PKGs, e.g. when using IBE for forward-secure encryption);
• the Bünz–Maller–Mishra–Vesely polynomial commitment scheme. (This could in principle be used for NIZK arguments of knowledge, although it has $\Theta(\sqrt{N})$ verification and so is not fully succinct.)

Answer 2

The introductory example for the use of pairings is tripartite Diffie-Hellman key exchange with a single message by Joux.

It requires no trusted party or CRS.

This nature of allowing a DH like interaction between 3 parties is the reason why many of the TTP setups work with pairings. It's used for the third party.