Turns "somewhat random" data into "perfectly random" data, like squeezing pure juice out of a pulpy orange.
The idea: Say an attacker learned 100 of the 256 bits of a key. There are still about 156 bits of uncertainty, just smeared across the whole key. Hash it with a function picked at random from a suitable family and you get a shorter key, say 128 bits, that is almost perfectly random to that attacker. You give up length to gain purity, and no hardness assumption is involved.
Why it matters: Cleans up the raw output of hardware random generators and quantum key distribution.
On the map: privacy amplification (leftover hash lemma): squeezes a partly leaked key into a secret one, also conditions hardware RNGs
An extractor turns a weak random source, one that is partly predictable or partly known to an attacker, into bits that are almost perfectly uniform. The leftover hash lemma[1] shows that hashing with a randomly chosen universal hash function does this, with no computational assumption.
Where you meet it: QKD uses it as "privacy amplification[2]" to squeeze out whatever the eavesdropper may have learned, and hardware random number generators use it to condition raw physical noise before it becomes key material.
If any of these breaks, this breaks too.
If this breaks, these break with it.