On RSA moduli with half of the bits prescribed

We give a probabilistic algorithm that constructs an RSA modulus M=pl with prescribed bit patterns, where primes p and l are both of n-bit size. Assume the Generalized Riemann Hypothesis. We show that the algorithm can generate an RSA modulus M with the least significant bits prescribed in advance, with time complexity of polynomial in n.