RSA with modulus n=p²q I've been wondering what would happen if the RSA modulus would be $n=p^2q$ instead of $n=pq$. I feel like there is an obvious security flaw (as there is with most modifications). Would this choise of $n$ make RSA less secure? If so, why? If not, then why isn't $n=p^2q$ standard since it allows operations on a bigger $\mathbb{Z}_n$? Btw, I'm talking about textbook RSA here.
Actually, that was proposed here back in 1998 (sorry, an electronic version of the paper does not appear to be on the web) -- the author claimed a modest speedup in the private operations.  However, that speed up would appear to be about the same if you just did "multiprime RSA", that is, selected an RSA modulus of the form $pqr$ for three distinct primes $p$, $q$ and $r$.

As for the security, well, reducing the size of the primes does make factoring methods such as ECM easier.  However, with the current state of the art, it would appear that ECM against a product of three 682-bit primes (whether two of the primes were duplicated or not) would be harder than doing NFS (which doesn't care how big the primes were); however it's still enough to make people uneasy.

If you are really interested in performance, you probably should look at Elliptic Curve systems anyways...