Dr. Lamport's Unfinished Business
R, 86 83 82 bytes
(or 64 bytes with additional NA values in output when length of hash result is greater than half the length of the private key N)

function(f,N,d=seq(b&lt;-sapply(f,function(b)b%/%2^(7:0)%%2))*2)N[(d-!b)*!d&gt;sum(N|1)]

Try it online!
Input is an array f of single-byte integers (representing the output of the hash function phi) and an array N (representing the ordered array from which to select a subset).
G=function(f,N){            # G is function with args f=array of bytes, N=array of values
  bits=                     # calculate the bits of f:
    sapply(f,function(b)    #   for each byte b in f
      b%/%2^(7:0)%%2)       #   get its bits
  d=seq(bits)               # define d as 1..number of bits 
  N[                        # now output the elements of N given by indices:
    (d*2-1+bits)            #   d*2-1+bits (these are the indices from the bytes of f)
             *!d&gt;sum(N|1)/2 #   multiplied by zero (FALSE) for bits that exceed the length of N
    ]
}