On the uniformity of distribution of the RSA pairs

Let m = pl be a product of two distinct primes p and l. We show that for almost all exponents e with gcd(e, φ(m)) = 1 the RSA pairs (x, xe) are uniformly distributed modulo m when x runs through • the group of units Zm modulo m (that is, as in the classical RSA scheme); • the set of k-products x = ai1 · · · aik , 1 ≤ i1 < · · · < ik ≤ n, where a1, · · · , an ∈ Zm are selected at random (that is, as in the recently introduced RSA scheme with precomputation). These results are based on some new bounds of exponential sums.