Editing Rabin cryptosystem (section)

===Effectiveness===
Decrypting produces three false results in addition to the correct one, so that the correct result must be guessed. This is the major disadvantage of the Rabin cryptosystem and one of the factors which have prevented it from finding widespread practical use.

If the plaintext is intended to represent a text message, guessing is not difficult; however, if the plaintext is intended to represent a numerical value, this issue becomes a problem that must be resolved by some kind of disambiguation scheme. It is possible to choose plaintexts with special structures, or to add [[padding (cryptography)|padding]], to eliminate this problem. A way of removing the ambiguity of inversion was suggested by Blum and Williams: the two primes used are restricted to primes congruent to 3 modulo 4 and the domain of the squaring is restricted to the set of quadratic residues. These restrictions make the squaring function into a [[Trapdoor function|trapdoor]] [[permutation]], eliminating the ambiguity.<ref name="bellare-goldwasser-bw-trapdoor">{{cite book
|title=Lecture Notes on Cryptography
|first1=Mihir
|last1=Bellare
|author-link1=Mihir Bellare
|first2=Shafi
|last2=Goldwasser
|author-link2=Shafi Goldwasser
|date=July 2008
|url=https://cseweb.ucsd.edu/~mihir/papers/gb.pdf#page=32
|section=§2.3.5 A Squaring Permutation as Hard to Invert as Factoring
|pages=32–33
}}</ref>