I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted to solve the other - for example, one reference claims:
The asymptotic running time of the best discrete logarithm algorithm is approximately the same as that of the best general-purpose factoring algorithm. Therefore, it requires about as much effort to solve the discrete logarithm problem modulo a 512-bit prime as it does to factor a 512-bit RSA modulus.
Now, I suspect that this isn't true, but I'd like to get a feel for why it isn't true.
For instance, as I understand it, the generalized number field sieve can be applied both to solve integer factorization and to solve discrete log. Why is it that it gives such an extreme speed up in integer factorization compared to brute-force, and less so in improving discrete log?
If the asymptotic running times for both applications are approximately the same, then I'm completely confused. I suspect that I'm comparing the wrong parameters, but how is it that ECC key-sizes can be so much smaller that in RSA?