# Why can we not use the group $Z_{p}^{*}$ for cryptography?

Sorry if this is a noob question, but for instance in ECDSA, we start by considering the field $\mathbb F_p$, whose the elements also form a group under multiplication. Why don't we just use this group instead of the one that is generated by the solutions of an elliptic curve equation lying in this field? I.E. choose an element lying in this field $g$ and choose a random number $n$ as a private key, and let $g^n$ be the public key. Is is just because of the reduction in key size? It seems like a high price to pay for the additional structure imposed by the curve equation.

• Are you specifically asking about DSA vs ECDSA? – mikeazo Sep 17 '18 at 11:05
• Rather about ElGamal v.s. ECDSA, I think – Erik Sep 17 '18 at 11:37
• I was almost sure we already had a question like "why use ECDSA instead of plain DSA?" lying around, but it looks like we don't. The closest thing I could find was this, which is not quite it. – Ilmari Karonen Sep 17 '18 at 11:43
• ...although we do also have this general question with some pretty nice answers. – Ilmari Karonen Sep 17 '18 at 11:46

You can use the multiplicative group $\mathbb{Z}_p^*$, provided you use a key long enough to be secure.