xxx

We get a prime p with bit-length approximately 2.5 that of the flag and 6 pairs such that is a point on the elliptic curve .

The crux and main thing to notice is that the coordinates for the flag-point are suspiciously generated as a random number less than the flag itself, thus it is “small” compared to the modulus.

So, probably a lattice problem. Subtracting pairs of the elliptic curve equations, we get a bunch of equations like

or,

where , but we don’t worry our pretty little heads about bounds, we just plug it in and pray that it’s enough to recover flag and indeed it is and we’re done.