Question: Just to establish notation with respect to the RSA protocol, let $n = pq$ be the product of two large primes and let $e$ and $d$ be the public and private exponents, respectively ($e$ is the inverse of $d \bmod \varphi(n)$). Given a plaintext message $m$, we obtain the ciphertext $c = m^e \bmod n$; we subsequently decrypt the ciphertext by calculating $c^d \bmod n$.

Suppose I'm trying to implement RSA on a device with low computational power, and these exponentiations take too long. I decide to make my implementation run faster by choosing small values for $e$ and $d$ (e.g. in the tens or hundreds). 

**Are there efficient attacks against such an implementation?**

Answer: 
In addition to the special case analytical attacks for small public exponents, I wouldn't use a low value of e due to Partial Key Exposure. See "[Exposing an RSA Private Key Given a Small Fraction of its Bits](http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.40.1461&rep=rep1&type=pdf).": 

> 
> Our results show that RSA, and particularly low public exponent RSA,
>  are vulnerable to partial key exposure.
> 
> 
> 

Edit: added quote
$e$ and $d$ *cannot* both be small, because $ed$ must equal at least $(p-1)(q-1)+1$, which is very large if the scheme is to provide any security against factoring algorithms.