ElGamal scheme

The practical complexity of the discrete logarithm has developed surprisingly similar to that of factoring (see Section 8.4.2), although no reduction between the two problems is known. As a consequence, the efficiency of the ElGamal scheme and RSA is rather similar, too. 

By the way, the situation with the ElGamal scheme is similar to that with RSA, although that scheme is not directly constructed from trap-door one-way permutations Existential forgery is possible with a key-only attack. However, no method for selective forgery with an active attack is known. 

ElGa85 Taher ElGamal A Public Key Cryptosystem and a Signature Scheme Based on Discrete Logarithms IEEE Transactions on Information Theory 31/4 (1985) 469-472. 

Schn92 Claus P. Schnorr Comparison of the DSA of NIST and the Signature Schemes of ElGamal and Schnorr 2. GMD-SmartCard Workshop, Feb. 4-5,1992, GMD, Rheinstr. 75, D-6100 Darmstadt (now 64295). 

---