 Common reference string

A common reference string is public setup data shared by the parties to a cryptographic protocol. Its distribution is specified by the cryptographic setup. In a non-interactive zero-knowledge proof, the prover and verifier can use the same string $\sigma$ without exchanging a new challenge during each proof.^[ref]

A common random string is the special case in which the setup string is uniformly sampled; more general reference-string models specify another efficiently generated distribution. Being public is compatible with its purpose: the cryptographic witness may be secret even though the reference string is available to everyone.

An original eight-bit example shows why format and distribution are distinct. A uniform eight-bit string satisfiesA generator that always outputs those eight zeros satisfies the same length requirement but gives that event probability one. Checking length alone cannot establish the intended sampling law. This example illustrates a distributional distinction, not a proposed secure setup.

The zero-knowledge simulator may also simulate the joint distribution of setup data and proof. Consequently, the definition must state how setup is generated and what generation-related information the relevant parties possess. A public string with the right shape is not by itself evidence for the security properties of a proof system.^[ref]