Why does Paillier have poor performance?

Can anyone explain to me why Paillier crypto system does not provide good performance?

I read here (pdf) that RSA and ElGamal provide better performance than Paillier algorithm.

• Where did you read this? I would be interested to see their results. – mikeazo Jul 15 '16 at 17:14
• Quote from the paper "In this paper private key bit sizes are selected as suggested by NIST recommendation. Private key size of 1024 bit for RSA, 160 bits for ElGamal and Paillier was used for experimental purpose because RSA provides same amount of security on 1024 bit key size as provided by Elgamal and Paillier on 160 bit." After reading that, I would not trust anything in the paper. It is completely wrong. – mikeazo Jul 15 '16 at 17:57
• Pretty much the entirety of section 4 of the paper makes me wonder if the authors even know how to use cryptography. – mikeazo Jul 15 '16 at 17:58
• Paillier has a larger ciphertext space than similar-strength RSS and ElGamal. That will make the calculations more expensive. It is also a little more complex than the other two. So it is less efficient, but I could not say by how much. Very optimized versions of Paillier are still fast for a number of use cases. – mikeazo Jul 16 '16 at 2:07
• @codesinchaos They don't really specify what they mean. Do they mean the exponent or the modulus? Stating a Paillier key in this way seems especially out of the ordinary. – mikeazo Jul 16 '16 at 22:54

Now Paillier is actually slower, primarily because the computations are done modulo $n^2$, which is twice as many bits as the modulus in RSA for similar security. It is not actually that bad because there are various shortcuts/optimizations, but you would expect RSA to be faster because the computations are simpler.