Answers are grounded in this paper and cite their sources.
We prove that RSA least significant bit is 1/2 + (1/[log c N]) secure, for any constant c (where N is the RSA modulus). This means that an adversary, given the ciphertext, cannot guess the least sigiiilicatnt bit of the plaintext with probability better than 1/2 + (1/[log c N]), unless he can break RSA.
No takes yet. Share an insight, caveat, or question.
Alexi et al. (1984) studied this question.
Synapse has enriched 8 closely related papers on similar clinical questions. Consider them for comparative context: