# Pairing-based cryptography VS ZK-proofs: what's more efficient for threshold systems?

In some papers (e.g. 1, 2) the authors approve that pairings are more efficient than classic zk-proofs (e.g. proof of discrete logarithm knowledge) for the described applications (threshold encryption, PVSS).

Let's see the differences between these approaches:

1. Proof:
• Pairings: there are no additional steps.
• ZK-proofs (non-interactive dlog knowledge): one (sometimes more) multiplication (we consider elliptic curve cryptography) in the group, hash-function, a couple of additional arithmetic operations.
2. Verification:
• Pairings: pairing, obviously.
• ZK-proofs: two (sometimes more) multiplication, one addition, hash-function.

But pairing is more expensive than point multiplication. If we consider a threshold system, verification is more important (because you should make a proof once and verify all other participants). In this case pairing-based cryptography is less efficient than zk-proofs. Am I wrong?

## 1 Answer

If you care only about verification, and your protocols are such that the pairing-based approach requires one pairing, while the alternative (so-called "zk-proof") approach requires, say, 2~4 multiplications, one addition, and one hash, then yes, you are right: the pairing-based solution is less efficient. For a rough comparison, see page 14 of my paper: if you pick some of the most common best choices for a pairing-friendly elliptic curve and a pairing-free elliptic curve, then the cost of a pairing will be roughly 8 times the cost of a multiplication (or exponentiation, since we were using multiplicative notations in this paper) in the pairing-free curve. There are two reasons behind that: not only do pairings require more computation than multiplication, it is also the case that the best-known pairing-free curves allow for more efficient operations than the best-known pairing-friendly curves.