In all algorithms I've seen that rely on pairings-based cryptography (some examples: snarks without PCPs, more snarks, sublinear ring signatures), a common reference string is required. Is this always the case? If so, what is it about pairings (or the algorithms that use them?) that means the CRS is needed?

I know ZCash got around this by using MPC to emulate a TTP as described here, here, and here, but I'm more interested in understanding why the CRS is necessary. To clarify, I don't mean why the party that generates it needs to be trusted, as I understand that the public parameters of the CRS cannot be generated without use of the 'private' component that must later be destroyed, but I would like to know why the public parameters are required?

(I've looked at is pairing based crypto ready for productive use thinking it might answer this question but it doesn't)


The introductory example for the use of pairings is tripartite Diffie-Hellman key exchange with a single message by Joux.

It requires no trusted party or CRS.

This nature of allowing a DH like interaction between 3 parties is the reason why many of the TTP setups work with pairings. It's used for the third party.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.