Why doesn't any cryptographic library apply the Lehman's method? Lehman's method can be described as;
Let $N=pq$. If the ration of $p/q$ is near a ratio of two small numbers $r/s$, then $ps$ and $qr$ are close to $\sqrt{nrs}$. The Fermat's method can be easy applied to $nrs$, and $p=\gcd(ps,n)$, $q=n/p$.
Why doesn't any cryptographic library apply the Lehman's method?
I think the question really is: why don't cryptographic libraries generating RSA keys check if $p$ and $q$ are such that $N$ would be easily to factorize by Lehman's method?
That's because the probability that this stands are negligible. One way to prove this is to establish that Lehman's method overall has cost $O(N^{1/3})$ for random distribution of $p$ and $q$ with whatever limit the generation method has, like $\max(p,q)&lt;2\min(p,q)$. GNFS and Lentra's ECM factorization are more credible ways to factor such $N$, and the later has to an even higher degree than Lehman's method the characteristic of having probability of success grow progressively with effort. So why bother with a test against Lehman's method when a rational adversary would skip Lehman's method in favor of GNFS or ECM?
Then one can ask: so why do some cryptographic libraries generating RSA keys check if $\lvert p–q\rvert$ is above some bound, apparently to protect against Fermat's factorization method? That's because it's a way to check some failure modes of the prime generator, including returning a constant value. And because $\lvert p–q\rvert&gt;2^{(n_\text{len}/2)–100}$ is mandated by FIPS 186-4, section B.3.1, item 2(d).
But why is there this check in FIPS 186-4? I guess that's essentially because it's been in the earlier ANSI X9.31:1988, combined with it's indirect way of checking some horrible RNG failure, and the unlikeliness that it would harm (even in a side-channel attack).
But why is there this check in ANSI X9.31:1988? My understanding is that's bowing to request of some member(s) of the committee, sponsored by bankers, who wanted to show that every reasonable precaution was taken. Based on my memory of what Bob Silverman (who stood at this committee and was instrumental in writing the standard) has reported, the rationale was to make it harder for a lawyer to repudiate an RSA signature in court, by a wrong but superficially credible argument on the tune of: these &quot;RSA signatures&quot; are not admissible evidence! It was not taken reasonable precautions to make the factorization of the modulus $N$ difficult. Look, even some algorithm known to XVIIth century mathematician Pierre de Fermat could have been used to forge that &quot;signature&quot; thing opposed to my client!