RSA/Rabin Least Significant Bits are 1/2 + 1/(poly(log N)) Secure.

Benny Chor, Oded Goldreich

Browse the full CRYPTO paper archive.