xxx
We get a prime p
with bit-length approximately 2.5 that of the flag and 6
pairs such that
is a point on the
elliptic curve .
The crux and main thing to notice is that the coordinates for the flag-point are suspiciously generated as a random number less than the flag itself, thus it is “small” compared to the modulus.
So, probably a lattice problem. Subtracting pairs of the elliptic curve equations, we get a bunch of equations like
or,
where , but we don’t worry our pretty little heads about bounds, we just plug it in and pray that it’s enough to recover flag and indeed it is and we’re done.