RSA with $\lambda(n)$ or $\varphi(n)$

The PKCS #1 v2.0 specifications suggest using $\lambda(n) = \mathrm{lcm}(p-1,q-1)$. What is the benefit of choosing $\lambda(n)$ over $\varphi(n) = (p-1)(q-1)$ in RSA key generation?

Choosing $\lambda(n)$ rather than $\varphi(n)$ may result in a smaller private exponent.
• ... and as there are attacks against RSA with (too) small exponent, one couldn't detect that the exponent is too small if one just looks at the exponent one gets using $\varphi$ instead of $\lambda$. – j.p. Jul 7 '15 at 8:45
• @fgrieu You're wrong about the "always": The calculation of the modular inverse is done with a smaller exponent by a factor of at least 2. But that does not necessarily imply, that the product $ed$ is smaller (it usually is). Small number example: $n=7\cdot 11 \Rightarrow \varphi=60; \lambda=30$. For $e=11$, we get that $d=11$ in both cases ($11 \cdot 11 = 1$ for both moduli). – tylo Jul 7 '15 at 14:09
• @YehudaLindell : $\;\;\;$ (I don't know anything about that attack, but) I got the impression from j.p.'s comment that the attack works whenever the smallest $d$ is (too) small. $\:$ Using $\phi(n)$ instead of $\lambda(n)$ wouldn't let the key generation algorithm detect that. $\;\;\;\;\;\;\;\;$ – user991 Jul 8 '15 at 21:09