El Gamal faster than RSA with the same modulus length?

Question

Why is El Gamal faster than RSA with the same modulus length?

Answer 1

I am assuming that you are mentioning this with reference to this PGP link. If so, the reason is not that El Gamal is faster straight out for encryption or decryption, but it is faster in total terms. As mentioned in the FAQ, since deciphering is done more often than enciphering, the total cost of the operation is lesser for El Gamal. That is why El Gamal can be considered faster.

In terms of being stronger, it might be considered that El Gamal might be a bit more stronger than RSA since calculating discrete logs is at least as tough as integer factorization. Check this for the literature surrounding this.

Others with more crypto knowledge than me can correct me if I am wrong.

Answer 2

El Gamal is faster because of the shorter exponents. In RSA you can choose a very short exponent e for encryption but the exponent d foe decryption will probably be 1024 bit long (for an modulus with 1024bit). For El Gamal the exponents can both be chosen independently. PGP suggests exponents of length 160bit. This makes El Gamal decryption faster even though an inverse has be calculated next to the exponentiation.