Implementing randomness extractors A randomness extractor is a function that takes an input sampled from high entropy distribution and outputs a value that is close to uniform distribution. It is slightly different from a PRG. PRGs take an input sampled from uniform distribution and output a larger length string which is computationally indistinguishable from uniform. Whereas randomness extractors take an input sample from high entropy distribution and output a smaller length string statistically close to uniform distribution.

In my scheme, I use randomness extractors. In the scheme, the extractor takes an element uniformly sampled from a subgroup of $Z_N^*$, where $N$ is a product of 2 large primes. The extractor needs to output a bit string. I want to implement the scheme but couldn't find any implementations of randomness extractors. Are there any randomness extractors in sagemath, or any other library?
Whereas randomness extractors take an input sample from high entropy distribution and output a smaller length string statistically close to uniform distribution.


Not quite.  A randomness extractor is not simply a function $F\colon A \to S$ such that $F(X)$ has small distance from uniform if $X$ has high min-entropy.  Rather, a randomness extractor is a keyed family of functions $F_k\colon A \to S$ such that if $K$ is uniformly distributed and $X$ has high min-entropy, then $F_K(X)$ has small distance from uniform.  In other words, the premise is that you already have a uniform random key.

So, there is essentially no reason to use a randomness extractor in a practical application.  Generally, either:


You have a secret with high enough min-entropy to do cryptography.


Great!  Use HKDF-SHA256 or your favorite KDF to derive keys from it for each cryptosystem you want to use.

You don't have a secret with high enough min-entropy to do cryptography.


No amount of cryptidigitation with randomness extractors will raise its min-entropy.  Just flip the coin a few more times.



Randomness extractors are essentially of theoretical interest only, so it is not surprising if you have trouble finding practical implementations of them labeled as such (although any universal hash serves as a randomness extractor with the leftover hash lemma).  If you actually want to do cryptography, just feed your initial secret with high min-entropy through a hash function like HKDF-SHA256 or SHAKE128.