New Improved Probabilistic version of RSA On the 2nd page of "New probabilistic public-key encryption based on the RSA cryptosystem" by Roman'kov (PDF), at last it says Alice can find "f" of order "l" with least probability of (1-1/l). I cannot understand how they came up with this probability.
Can anyone help me with this.
The paper is rather sloppily written, however it can be changed into the correct statement.

The statement in the paper is:


  She takes randomly elements $f \in F^*_p$ and checks whether or not $f^{2x}=1$. With probability at least $1 − 1/\ell$ she finds $f$ of order $\ell$.


As written, that's wrong.  However, if we modify it to:


  She takes a random element $f \in F^*_p$ and computes $g = f^{2x}$; if $g \ne 1$ (which will happen with probability $1 − 1/\ell$), then $g$ will be of order $\ell$.


Then it is a correct statement (and is the standard way of generating random elements of order $\ell$).

There are a number of places in the paper like this; places where, as written, it doesn't make much sense, but if you know your number theory, you can deduce what the author actually meant.  I suspect that this can be modified to make a secure cryptosystem; however whether it does have any advantage over RSA (and whether it's actually safe for multiple users to use the same modulus and different exponents) is far less clear.