8
Yes, you can create many such functions.
For instance, lets build such a function based on SHA512. Generate some random value $m_0$ and generate a hash of it. It is important, because there is no guarantee that every 512-bit number has a pre-image.
So, let $h_0 = \operatorname{SHA512}(m_0)$. After hash generated, throw $m_0$ away. Technically you can do that ...
2
The issue is, the message length is now longer than the modulus $p$ and $q$
That's not true. In the $p$ track, you are raising $M \bmod p$ to the power $d \bmod p-1$; we have $M \bmod p < p$; that is, the value we are exponentiating is less that $p$, as results by Montomery multiplication. In the same way, the $q$ track also satisfies the requirements ...
2
good_RNG could be described as: an implementation of an unbiasing (or randomness extraction, or post-processing) algorithm performing the eXclusive-OR of 200 consecutive outputs of bad_RNG, using a loop unrolled by a factor of two, likely with an accidental data-dependent timing dependency beyond that in bad_RNG.
This is because
when $\mathtt{foo}\in\{0,1\}$...
2
The algorithm described is an unbiasing algorithm, which is a type of randomness extraction algorithm.
Another method is von Neumann unbiasing where you
can take 2 bits $(X_n,X_{n+1})$ and output $Z=0$ if
$(X_n,X_{n+1})=(0,1),$ output $Z=1,$ if
$(X_n,X_{n+1})=(1,0),$ and discard the two
bits otherwise. This gives exactly uniform
output bits, if the sequence $...
1
First, I understand your question and the frustration that comes along with it, and it is not uncommon. I will warn you that from my perspective, there isn't really an easy answer that provides quick satisfaction. But let me try to point you in the right direction.
For a simple beginning path, I will point you to Jean-Philippe Aumasson's book, "Serious ...
Only top voted, non community-wiki answers of a minimum length are eligible
