The first part of the talk will provide a survey of attacks on RSA with special parameters. Restricted RSA parameters can be considered as a relaxation of the problems of taking eth roots and the factorization problem, respectively. We give certain bounds under which the underlying problems become solvable in polynomial time. In the second part of the talk, we will present a new lattice-based attack on RSA with Small CRT-exponents. The attack is polynomial time whenever both d mod p-1 and d mod q − 1 are smaller than N0.073.