On the security of server-aided RSA protocols