2 ms·
You'd want something like this: Truncate( SHA-512(0x01 || message || private_key) || SHA-512(0x02 || message || private_key), bitsNeeded ) T
by some_furry 3y ago
You'd want something like this:
Truncate(
SHA-512(0x01 || message || private_key)
|| SHA-512(0x02 || message || private_key),
bitsNeeded
)
Two separate hashes, with domain separation, that produce an output of at least n+64 bits (if it is to be reduced mod 2^n - k, for some small integer k). In this case, 1024 bits reduced mod 2^521-1 is safe.
Even better, though, is to just use RFC 6979 and not implement it yourself.