Can you recognize a low private exponent from a public key? In the RSA cryptosystem, Wiener, Boneh and Durfee showed that low private exponents can be efficiently recovered. Is it possible to see from a public key alone whether the private exponent (d) is small? Is the public exponent (e) then necessarily large? Is it possible to have a small private exponent when e=65537?
When generating keys, $d$ and $e$ are each others modular inverse:


$d \times e \equiv 1 \pmod{ \lambda(n)}$
$d \times e = 1 + k \times \lambda (n)$


Unless $d = e = 1$, this means that $d \times e$ is at least $\lambda(n)$, otherwise it would not "wrap around" to become $1$. So $k$ is at least $1$:


$d \times e \ge 1 + \lambda(n)$


This means that at least one of $d$ and $e$ is at least $\sqrt{1 + \lambda(n)}$, otherwise they wouldn't multiple to be greater.


$d \ge \sqrt{\lambda(n)}$, or $e \ge \sqrt{\lambda(n)}$


If we set $e = 65537$, it must be $d$ that is large. It is not possible to have a key with a low private exponent that also has a low public exponent. A key with a low private exponent has to have a public exponent that is at least $\sqrt{\lambda(n)}$.