3

No. For example, these pairing-based protocols don't require trusted setup: BLS signatures; tripartite Diffie-Hellman, as mentioned in Elias' answer; some identity-based encryption schemes (when users are their own PKGs, e.g. when using IBE for forward-secure encryption); the Bünz–Maller–Mishra–Vesely polynomial commitment scheme. (This could in principle ...


2

The linked paper is not about Elliptic Curves which relies on additive groups. It is about the multiplicative groups. For both of them the discrete logarithm is defined. There are common notations that confuse people about them. In the multiplicative version, the division is actually not a division like in the reals. It is the inverse in the group and ...


1

I've always used it as #1. Hyperledger Ursa has an implementation in Rust (see https://github.com/hyperledger/ursa/tree/master/libzmix/bbs). However, it is a type of group signature which allows the type of signing of multiple messages. When someone says to me group signature I immediately think your #2. If we look at a paper written by David Chaum (https://...


Only top voted, non community-wiki answers of a minimum length are eligible