If the message m is a uniform, 128-bit string then m cannot be recovered in its entirety from the ciphertext in polynomial time. (Here, assume N is at least 1000 bits long, and e=3.)

If the message m is uniform in Z^*_N, then no information about m can be recovered from the ciphertext in polynomial time.

The scheme is CPA-secure, but not CCA-secure.

If the message m is uniform in Z^*_N, then m cannot be recovered in its entirety from the ciphertext in polynomial time.