RSA Key Recovery Reduces to Factoring