8

Yes, you can create many such functions. For instance, lets build such a function based on SHA512. Generate some random value $m_0$ and generate a hash of it. It is important, because there is no guarantee that every 512-bit number has a pre-image. So, let $h_0 = \operatorname{SHA512}(m_0)$. After hash generated, throw $m_0$ away. Technically you can do that ...


2

The issue is, the message length is now longer than the modulus $p$ and $q$ That's not true. In the $p$ track, you are raising $M \bmod p$ to the power $d \bmod p-1$; we have $M \bmod p < p$; that is, the value we are exponentiating is less that $p$, as results by Montomery multiplication. In the same way, the $q$ track also satisfies the requirements ...


2

good_RNG could be described as: an implementation of an unbiasing (or randomness extraction, or post-processing) algorithm performing the eXclusive-OR of 200 consecutive outputs of bad_RNG, using a loop unrolled by a factor of two, likely with an accidental data-dependent timing dependency beyond that in bad_RNG. This is because when $\mathtt{foo}\in\{0,1\}$...


2

The algorithm described is an unbiasing algorithm, which is a type of randomness extraction algorithm. Another method is von Neumann unbiasing where you can take 2 bits $(X_n,X_{n+1})$ and output $Z=0$ if $(X_n,X_{n+1})=(0,1),$ output $Z=1,$ if $(X_n,X_{n+1})=(1,0),$ and discard the two bits otherwise. This gives exactly uniform output bits, if the sequence $...


1

First, I understand your question and the frustration that comes along with it, and it is not uncommon. I will warn you that from my perspective, there isn't really an easy answer that provides quick satisfaction. But let me try to point you in the right direction. For a simple beginning path, I will point you to Jean-Philippe Aumasson's book, "Serious ...


Only top voted, non community-wiki answers of a minimum length are eligible