Let $N < 2^a$ be a positive integer chosen uniformly at random. Let $\tilde{N}$ be the result of removing from $N$ all its prime factors less than $2^b$. What is the probability that $\tilde{N}$ is composite and $\tilde{N} > 2^c$?

The problem is similar to [Integers with a large smooth divisor](https://pdfs.semanticscholar.org/d48d/d2229998b82b00d27a65d8dac70012c3ed91.pdf), with "smooth" replaced by ["rough"](https://en.wikipedia.org/wiki/Rough_number).

**Motivation**

I want to build the smallest-possible safe RSA modulus without a trusted party. A positive integer is a **safe RSA modulus** if, after removing all its prime factors less than 512 bits, it is composite and has size at least 2048 bits.

(That is we set $b=512$ and $c=2048$ in the above problem. The parameter $b=512$ protects against the [ECM](https://en.wikipedia.org/wiki/Lenstra_elliptic-curve_factorization) which has found primes of size [up to 273 bits](https://members.loria.fr/PZimmermann/records/top50.html). The parameter $c=2048$ protects against the [GNSF](https://en.wikipedia.org/wiki/General_number_field_sieve) which factored numbers up to 768 bits.)

The strategy is to randomly sample several random numbers $N_1, ..., N_k$ and multiply them together. Each $N_i$ has some probability $p$ of being a safe RSA modulus so the product $N_1...N_k$ has probability $1 - (1-p)^k$ of being safe.

To choose $k$ appropriately I need a reasonably tight lower bound for $p$. (The above strategy of multiplying randomly chosen integers was [pioneered by Thomas Sanders](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.28.4015&rep=rep1&type=pdf) but he used a different—unnecessarily strict—definition of a safe RSA modulus.)