In RSA, rationale for prime $p$ with $p-1$ having prime factor $u$ with $u-1$ having large prime factor?
This issue, and its history, was discussed at length in Silverman and Rivest. The relevant passage here is in Section 6, which I quote:


  In 1977 Simmons and Norris [53] discussed the following "cycling" or
  "superencryption" attack on the RSA cryptosystem: given a ciphertext
  C, consider decrypting it by repeatedly encrypting it with the same
  public key used to produce it in the first place, until the message
  appears. Thus, one looks for a fixed point of the transformation of
  the plaintext under modular exponentiation. Since the encryption
  operation effects a permutation of $\mathbb{Z}_n =  \{0,1,\ldots,n-1\}$, the message can eventually be obtained in this
  manner. Rivest [46] responds to their concern by (a) showing that the
  odds of success are minuscule if the n is the product of two
  $p^{--}$-strong primes, and (b) arguing that this attack is really a
  factoring algorithm in disguise, and should be compared with other
  factoring attacks.