Comment by williamstein

> In cryptography, most of the problems believed to be exponentially hard, such as factoring, don't have proofs of an exponential lower bound.

There are subexponential algorithms for integer factorization, e.g., the general number field sieve and Lenstra’s ECM.