= Common reference string
{title2=$\sigma$}
A \b[common reference string] is public setup data shared by the parties to a <cryptographic protocol>. Its distribution is specified by the <cryptographic setup>. In a <non-interactive zero-knowledge proof>, the prover and verifier can use the same string $\sigma$ without exchanging a new challenge during each proof.<Zero-Knowledge: a tutorial by Oded Goldreich>[Section8, reference-string model]{ref}
A common random string is the special case in which the setup string is uniformly sampled; more general reference-string models specify another efficiently generated distribution. Being public is compatible with its purpose: the <cryptographic witness> may be secret even though the reference string is available to everyone.
An original eight-bit example shows why format and distribution are distinct. A uniform eight-bit string satisfies
$$
\Pr(\sigma=00000000)=2^{-8}=\frac1{256}.
$$
A generator that always outputs those eight zeros satisfies the same length requirement but gives that event probability one. Checking length alone cannot establish the intended sampling law. This example illustrates a distributional distinction, not a proposed secure setup.
The <zero-knowledge simulator> may also simulate the joint distribution of setup data and proof. Consequently, the definition must state how setup is generated and what generation-related information the relevant parties possess. A public string with the right shape is not by itself evidence for the security properties of a proof system.<Zero-Knowledge: a tutorial by Oded Goldreich>[Section8, real and simulated reference-string/proof pairs]{ref}
Back to article page
