text: In 1999, Joye, Lenstra and Quisquater [6] showed that this attack can use only
  the faulty signature Ŝ and the message m and retrieve either p or q by computing gcd(N,m− Ŝe) with an overwhelming probability.