Why can ECC key sizes be smaller than RSA keys for similar security? I understand how ECC is based on the discrete log problem and RSA on integer factorization. I've read several references that show how a solution to either of these problems can typically be adapted to solve the other - for example, one reference claims: 


  The asymptotic running time of the best discrete logarithm algorithm
  is approximately the same as that of the best general-purpose
  factoring algorithm. Therefore, it requires about as much effort to
  solve the discrete logarithm problem modulo a 512-bit prime as it does
  to factor a 512-bit RSA modulus.


Now, I suspect that this isn't true, but I'd like to get a feel for why it isn't true.

For instance, as I understand it, the generalized number field sieve can be applied both to solve integer factorization and to solve discrete log. Why is it that it gives such an extreme speed up in integer factorization compared to brute-force, and less so in improving discrete log?

If the asymptotic running times for both applications are approximately the same, then I'm completely confused. I suspect that I'm comparing the wrong parameters, but how is it that ECC key-sizes can be so much smaller that in RSA?
Actually, the problem is that the above quote uses the term "discrete log" in a way that's different from what you're thinking of.

When someone uses the term "discrete log", they can mean two things:


A discrete log in the group $Z^*_p$; that is, given $p$, $g$ and $g^x \bmod p$, recover $x$
A discrete log in some other group; that is, given a group $G$, a generator $g$ and the value $g^x$, recover $x$.


Of course, the precise meaning is given by context.

In this specific case, the quote refers to the first meaning of discrete log; a log over a multiplicative group modulo a prime (and for such a group, there exist subexponential ways of solving it).

However, when we're dealing with the security of an EC group, we don't care about discrete logs modulo $Z^*_p$; instead, we care about the discrete log within the EC group (that is, the second meaning).  These EC groups (or, at least, the ones based on curves that we actually use) do not have these fast methods of solving it; in particular, the number field sieve algorithm does not appear to apply.

And, because the DLOG problem in an EC group is much harder, we can use a smaller EC curve safely.