# ElGamal and Schnorr groups

As I gather, a normal practice for choosing a cyclic group for ElGamal key generation is to find a safe prime $p$ and use a multiplicative cyclic group with modulus $p$ and order $q = (p-1)/2$. However, generating safe primes of a large length can be quite time-consuming. Would it be safe to use a Schnorr group as an alternative?

If there is no safe way, what minimum size can I use for a safe prime so that it would be both secure and not terribly long to choose?

Note the obvious: for Elgamal signature generation you must share parameters between users. If I (re-)read Elgamal encryption then it seems to me that parameter $p$ or $q$ (the safe prime) need to be shared in advance as well. Even though the generation of safe primes may be time consuming, you don't need to do this for each signature generation or decryption - the parameters may be static.
• Thank you very much, this answers all of my questions except for one - are there any real security disadvantages of using a group with a Schnorr subgroup instead of a safe prime (e.g. $p = q*R + 1$ instead of $p = q*2 + 1$)? – Mints97 Jan 24 '15 at 11:20