How rare are 1024-bit $B$-smooth numbers? What is the probability that if I choose a random $1 &lt; r &lt; n - 1$, $r^{65537} \pmod n$ will be $B$-smooth?  $n$ is a 1024-bit RSA modulus.

The Wikipedia pages on smooth numbers and the Dickman function are too obtuse for me to understand enough to calculate for my particular case.

I was contemplating an attack on something that uses a broken PKCS #1 v1.5 signature padding check.  I figured that if I found find many such $r$, I could forge signatures by manipulating the unchecked parts of the "message representative" to make it factor over the factor base $B$.  The signature then would be calculable as a linear matrix.

This all resembles parts of the quadratic sieve algorithm.  Quadratic sieve would be too difficult to do on a 1024-bit number, so it's quite possible that this attack idea is infeasible just from the rarity of smooth numbers.
If $n$ is a 1024-bit RSA modulus usable with $e=65537$ (as in the attack contemplated, and for >99.99% of $n=p\;q$ with $p$ and $q$ prime), then $r\mapsto r^{65537}\bmod n$ is a permutation of the set $[2,n-2]$. Thus if $r$ is uniformly random in this set, then so is $r^{65537}\bmod n$. For cryptanalytic purposes, it suffices that $r$ is chosen independently of the particular $n$.

The proportion of $B$-smooth among these is $\psi(n,B)/n$, and for fixed ratio $u=\log(n)/\log(B)$ and large $n$ that's $\rho(u)+O(1/\log(n))$, where $\rho$ is Dickman's function [in its modern definition; Donald E. Knuth's The Art of Computer Programming, section 4.5.4, studies $F(x)=\rho(1/x)$ ]. In cryptanalysis, $\rho(\log(n)/\log(B))$ is often used as an approximation of the density of $B$ smooth, ignoring the $O(1/\log(n))$ term. Caution: I can't tell how justified that is!

For example, if $B=2^{256}$, the proportion of $B$-smooth among integers less than $2^{1024}$ is approximately $\rho(1024/256)=\rho(4)\approx 0.00491\approx2^{-7.67}$. For $B=2^{128}$ that approximation is down to $\rho(8)\approx2^{-24.88}$.

Here is a table of $\log_2(\rho(u))$ for $u$ from $1$ to $25$ by steps of $\frac1 4$ (obtained using that code).
$$\begin{array}{r|rrrrrrrrr}
u&amp;+0&amp;+\frac1 4&amp;+\frac1 2&amp;+\frac3 4&amp;+1\\
\hline
1&amp;0\ \ \ \ \ &amp;-0.36&amp;-0.75&amp;-1.18&amp;-1.70\\
2&amp;-1.70&amp;-2.30&amp;-2.94&amp;-3.62&amp;-4.36\\
3&amp;-4.36&amp;-5.14&amp;-5.95&amp;-6.79&amp;-7.67\\
4&amp;-7.67&amp;-8.58&amp;-9.51&amp;-10.47&amp;-11.46\\
5&amp;-11.46&amp;-12.47&amp;-13.50&amp;-14.56&amp;-15.64\\
6&amp;-15.64&amp;-16.73&amp;-17.84&amp;-18.98&amp;-20.12\\
7&amp;-20.12&amp;-21.29&amp;-22.47&amp;-23.67&amp;-24.88\\
8&amp;-24.88&amp;-26.11&amp;-27.35&amp;-28.61&amp;-29.87\\
9&amp;-29.87&amp;-31.15&amp;-32.45&amp;-33.75&amp;-35.07\\
10&amp;-35.07&amp;-36.40&amp;-37.74&amp;-39.09&amp;-40.45\\
11&amp;-40.45&amp;-41.82&amp;-43.21&amp;-44.60&amp;-46.00\\
12&amp;-46.00&amp;-47.41&amp;-48.83&amp;-50.26&amp;-51.70\\
13&amp;-51.70&amp;-53.15&amp;-54.61&amp;-56.07&amp;-57.54\\
14&amp;-57.54&amp;-59.02&amp;-60.51&amp;-62.01&amp;-63.51\\
15&amp;-63.51&amp;-65.03&amp;-66.55&amp;-68.07&amp;-69.61\\
16&amp;-69.61&amp;-71.15&amp;-72.69&amp;-74.25&amp;-75.81\\
17&amp;-75.81&amp;-77.38&amp;-78.95&amp;-80.53&amp;-82.12\\
18&amp;-82.12&amp;-83.71&amp;-85.31&amp;-86.92&amp;-88.53\\
19&amp;-88.53&amp;-90.15&amp;-91.77&amp;-93.40&amp;-95.04\\
20&amp;-95.04&amp;-96.68&amp;-98.32&amp;-99.97&amp;-101.63\\
21&amp;-101.63&amp;-103.29&amp;-104.96&amp;-106.63&amp;-108.31\\
22&amp;-108.31&amp;-109.99&amp;-111.68&amp;-113.37&amp;-115.07\\
23&amp;-115.07&amp;-116.77&amp;-118.48&amp;-120.19&amp;-121.91\\
24&amp;-121.91&amp;-123.63&amp;-125.35&amp;-127.08&amp;-128.82\\
\end{array}$$
For $\psi(n,B)/n$ with bounding or/and lower $B$, one can use Bernstein's psibound.