In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption, PVSS).
Let's see the differences between these approaches:
- Pairings: there are no additional steps.
- ZK-proofs (non-interactive dlog knowledge): one (sometimes more) multiplication (we consider elliptic curve cryptography) in the group, hash-function, a couple of additional arithmetic operations.
- Pairings: pairing, obviously.
- ZK-proofs: two (sometimes more) multiplication, one addition, hash-function.
But pairing is more expensive than point multiplication. If we consider a threshold system, verification is more important (because you should make a proof once and verify all other participants). In this case pairing-based cryptography is less efficient than zk-proofs. Am I wrong?