Alice and Bob calculated a shared key on the elliptic curve y^2 = x^3 + 330762886318172394930696774593722907073441522749x^2 + 6688528763308432271990130594743714957884433976x + 759214505060964991648440027744756938681220132782 p = 785482254973602570424508065997142892171538672071 G = (1, 68596750097555148647236998220450053605331891340) (Alice's public key) P = d1 * G = (453762742842106273626661098428675073042272925939, 680431771406393872682158079307720147623468587944) (Bob's poblic key) Q = d2 * G = (353016783569351064519522488538358652176885848450, 287096710721721383077746502546881354857243084036) They have calculated K = d1 * d2 * G. They have taken K's x coordinate in decimal and took sha256 of it and used it for AES ECB to encrypt the flag. Here is the encrypted flag: 480fd106c9a637d22fddd814965742236eb314c1b8fb68e70a7c7445ff04476082f8b9026c49d27110ba41b95e9f51dc

The challenge name suggests that the elliptic curve is singular.

Factoring

The discriminant of a elliptic curve is

The properties of the discriminant:

• Invariance by translation
• 0 if a repeated root exists

We notice that the discriminant of the curve given under mod , meaning it can be factored into $ where is a repeated root of multiplicity two and is a root.

Applying such a factorization to the polynomial gives us a triple root:

Additive group

By transforming , the curve becomes which is (in)famous for degenerating into the additive group via the mapping and

Now ECC point addition is simply adding s together, so the DLP is trivial via modular division