Hastad J. (1986) N Using RSA with Low Exponent in a Public Key Network. In: Williams H.C. (eds) Advances in Cryptology — CRYPTO ’85 Proceedings. CRYPTO 1985. Lecture Notes in Computer Science, vol 218. Springer, Berlin, Heidelberg
We consider the problem of solving systems of equations Pi(x) ≡ 0 (mod ni) i = 1...k where Pi are polynomials of degree d and the ni are distinct relatively prime numbers and x < min ni. We prove that if k > d(d+1)/2 we can recover x in polynomial time provided ni > > 2k. This shows that RSA with low exponent is not a good alternative to use as a public key cryptosystem in a large network. It also shows that a protocol by Broder and Dolev  is insecure if RSA with low exponent is used.