Repeatedly apply the public RSA cryptosystem encryption map to a ciphertext. A return to that ciphertext reveals its preceding iterate as the plaintext. A nontrivial greatest common divisor between an iterate-minus-start and the modulus instead enables integer factorization. Eventual return alone supplies no useful running-time bound.
New to topics? Read the docs here!