1
$\begingroup$

In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption, PVSS).

Let's see the differences between these approaches:

  1. Proof:
    • Pairings: there are no additional steps.
    • ZK-proofs (non-interactive dlog knowledge): one (sometimes more) multiplication (we consider elliptic curve cryptography) in the group, hash-function, a couple of additional arithmetic operations.
  2. Verification:
    • Pairings: pairing, obviously.
    • ZK-proofs: two (sometimes more) multiplication, one addition, hash-function.

But pairing is more expensive than point multiplication. If we consider a threshold system, verification is more important (because you should make a proof once and verify all other participants). In this case pairing-based cryptography is less efficient than zk-proofs. Am I wrong?

$\endgroup$
1
$\begingroup$

If you care only about verification, and your protocols are such that the pairing-based approach requires one pairing, while the alternative (so-called "zk-proof") approach requires, say, 2~4 multiplications, one addition, and one hash, then yes, you are right: the pairing-based solution is less efficient. For a rough comparison, see page 14 of my paper: if you pick some of the most common best choices for a pairing-friendly elliptic curve and a pairing-free elliptic curve, then the cost of a pairing will be roughly 8 times the cost of a multiplication (or exponentiation, since we were using multiplicative notations in this paper) in the pairing-free curve. There are two reasons behind that: not only do pairings require more computation than multiplication, it is also the case that the best-known pairing-free curves allow for more efficient operations than the best-known pairing-friendly curves.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.