Current situation of bilinear pairing protocols

Question

The bilinear pairings are considered as the key enabler for many novel cryptographic protocols, such as three-party one round DH[1], shorter signatures and certificateless (ID-based) crypto[3] , which employ Tate and Weil pairings. Lots of promising research and progress has been made in the last decade, and the pairing concept has been hyped quite a bit.

However, there are also some sources claiming that pairings are "useless", for example this article from 2015: On the Disadvantages of Pairing-based Cryptography from university of Shanghai.

As a summary, the article claims that BPC (Bilinear pairing crypto) doesn't bring any advantage, and in fact requires significantly large key sizes. But the article only seems to consider Tate and Weil pairings, and only the short signature protocol.

Also, I haven't somehow found much new research or progress about current situation of pairing concepts from the past 5 years. I assume that at least pairings utilizing Tate and Weil are obsolete, as Ate and optimal Ate over BN-curves have turned out to be much more efficient.

So finally my question is: Are the bilinear pairings still considered useful, and what are the main advantages? I have assumed that they are so far the only way to implement protocols such as ID-based cryptography.

Sources:
A. Joux, (2000) “A one round protocol for tripartite Diffie-Hellman”
D. Boneh and M. Franklin,(2001) “Identity-based encryption from the Weil pairing”

Answer 1

That paper is misleading in several ways:

• The DSA vs BB comparison: it is unfair because it compares DSA with the "full" BB scheme, which does not produce shorter signatures. The same BB paper describes a "basic" scheme that has a signature that is half the size of DSA. That's the whole point of short signature schemes (being shorter than ECDSA/DSA). This point is now moot, however, since a 2015 paper describing an attack that required pairing-based crypto to increase its parameter sizes, making short signatures not that short anymore (which does support the authors' claim, but that was not the justification they used).
• They estimate that BB is 60 times slower than DSA but give no justification. While signature verification will indeed be slower, signing should be faster.
• They raise the issue of the master key in PBC schemes. This is true, but only applies to ID-based crypto, and was known from the start.

Pairings are still relevant because some schemes can only be implemented efficiently using them. Zcash uses pairings to implement a zero-knowledge protocol; TPM chips use pairings to implement Direct Anonymous Attestation; for example.