# DSA vs. ElGamal vs. Schnorr

It has been well known for a long time that NSA played a primary role in the development of the Digital Signature Algorithm (DSA).

DSA is a sort of hybrid of the ElGamal and Schnorr signature schemes.

My question is this. Based on what we know now, why did NSA invent a new scheme rather than just adopt ElGamal or Schnorr? I am looking for informed speculation based on what is known today about the relative strengths and weaknesses of these schemes, with references. (References for the strengths and weaknesses, I mean, not for the speculation.)

If your speculation is that NSA did something to weaken DSA, what could they possibly have gained other than the ability to forge signatures?

Or was DSA just the result of IP concerns? If so, I would like to see a reference for that, too.

-
Crypto, by Steven Levy, is a fantastic exploration of the history of public key, and touches on these issues. – Ethan Sep 4 '14 at 22:20

As for ElGamal signatures: that scheme is more expensive. ElGamal signatures work modulo a prime $p$ and require one modular exponentiation (for generation) or two (for verification) with exponents as big as $p$; and the signature is two integers modulo $p$. This contrasts with DSA and Schnorr, which both work in a subgroup, traditionally a 160-bit subgroup for a 1024-bit modulus. DSA and Schnorr are 6 times faster than ElGamal, and produce signatures which are 6 times smaller. This difference in performances is enough to explain not choosing ElGamal. Indeed, the short size of DSA and Schnorr signatures has long been the selling point for these algorithms when compared to RSA.