How the coin flipping protocol prevent Alice from generating $ n $ from many primes? This is a question from reading the paper 'Coin Flipping by Telephone - a protocol for solving impossible problems'.
The fact that the coin is unbiased is based on the fact that if n is a product of two primes, then there should be exactly four solutions to the congruence $ x^2 = f^2 \pmod n $.
What if Alice is malicious and intentionally want to bias the result towards $ n $ is factorizable. In that case, she could make $ n $ a composite out of a few primes (let's say, 5), then there will be $ 2^5 = 32 $ solutions and it will be highly likely that picking a solution will lead to $ n $ turns out to factorizable?
Note that Step II of the protocol is titled &quot;ALICE TESTS n&quot; and this includes a method for Alice to verify that Bob chose n correctly. This appears on the third page of the paper.