Ariana's Site

There is always a starting point, isn't it?

Files given:

def ison(C, P):
	c, d, p = C
	u, v = P
	return (u**2 + v**2 - c**2 * (1 + d * u**2*v**2)) % p == 0

c, d, p = Curve

flag = flag.lstrip(b'CCTF{').rstrip(b'}')
l = len(flag)
lflag, rflag = flag[:l // 2], flag[l // 2:]

s, t = bytes_to_long(lflag), bytes_to_long(rflag)
assert s < p and t < p

P = (398011447251267732058427934569710020713094, 548950454294712661054528329798266699762662)
Q = (139255151342889674616838168412769112246165, 649791718379009629228240558980851356197207)

print(f'ison(C, P) = {ison(Curve, P)}')
print(f'ison(C, Q) = {ison(Curve, Q)}')

print(f'P = {P}')
print(f'Q = {Q}')

print(f's * P = {peam(Curve, P, s)}')
print(f't * Q = {peam(Curve, Q, t)}')

The code uses the Edwards model of an elliptic curve. First, we can easily solve for as we are given points on the curve

by solving for various pairs of points then taking an appripriate GCD of all the s.

In order to convert this back into an elliptic curve to use sage functions on, we use the help of mathematica to verify our computations: calc.nb

Substitute

Now this finally allows us to input the elliptic curve into sage:

python

sage: a = -(9*c^8*d^2+126*c^4*d+9)/27
....: b = -(2*c^12*d^3-66*c^8*d^2-66*c^4*d+2)/27
....: E = EllipticCurve(FF,[a,b])
....: print(factor(E.order()))
2^2 * 4911931 * 50689183 * 350206513 * 1138886473 * 2275732843

which means discrete log is easy! We can now run discrete log and get the flag quite quickly.

Solution at solve.sage

Rohald