EC-DH-AES

m = hashlib.sha1()
m.update(long_to_bytes(int(datetime.now().timestamp())))
m.update(os.urandom(4))
m.update(FLAG)
server_private_key = bytes_to_long(m.digest())
# (from chal.py)

E = EllipticCurve(GF(p), [a, b])
print(factor(E.order()))

def point_multiplication(P, n):
    Q = P
    R = O
    while n > 0:
        if n % 2 == 1:
            R = point_addition(R, Q)
        Q = point_addition(Q, Q)
        n = n // 2
    assert check_point(R)
    return R
# (from chal.py)

from sage.all import *
import socket
import ast
from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
from Crypto.Util.number import long_to_bytes
# ...existing code...

# The challenge's AES key derivation and encryption:
shared_point = point_multiplication(server_public_key, client_private_key)
AES_key = long_to_bytes(shared_point.x ^ server_private_key)
cipher = AES.new(AES_key, AES.MODE_ECB)
ciphertext = cipher.encrypt(pad(FLAG, 16))
# (from chal.py)

# --- Challenge Parameters ---
# "Standard" custom curve constants
p = 0xef15044248691197b46bf7c58045ca09919237c0acb7e10b0b7a10115e33bacf
a = 0x7c7ab0de24a6d60f0cf17c4cbdb25c23b4e22b5f6a88bd79894ef44cd0375dff
b = 0xf45b986d9c01a78504a95af55035e336a5a7acfa33e700595502af80a6a7fbbd
Gx = 0x90f7928935a959dea114d3efcf44272a8a39c26c8311ac1ee3771878ffdcd1a9
Gy = 0xd3f156fc5c525a91b5c9ae985e666d1349a170cae3f81658f28210b0270bf1fe

def solve():
    print("[*] Connecting to server...")
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect(('0.cloud.chals.io', 18923))
        f = s.makefile('r')
    except Exception as e:
        print(f"[-] Connection failed: {e}")
        return

    # 1. Parse Output
    f.readline() # Timestamp
    line_priv = f.readline().strip()
    line_pub  = f.readline().strip()
    line_flag = f.readline().strip()

    client_priv_key = int(line_priv.split('! ')[1], 16)
    server_pub_x    = int(line_pub.split('! ')[1], 16)
    encrypted_flag  = ast.literal_eval(line_flag.split('! ')[1])

    print(f"[*] Client Private Key: {hex(client_priv_key)}")
    print(f"[*] Server Public X:    {hex(server_pub_x)}")

    # 2. Setup Curve
    F = GF(p)
    E = EllipticCurve(F, [a, b])
    G = E(Gx, Gy)
    
    # 3. Factor Order and Filter Small Factors
    print("[*] Calculating Curve Order and Factors...")
    order = E.order()
    factors_list = list(factor(order))
    
    # We ignore the massive 106-bit factor. We ain't got time for that.
    # We keep everything under 60 bits.
    small_factors = [fac for fac in factors_list if fac[0] < 2**60]
    
    # Calculate the modulus M (product of small factors)
    M = 1
    for fac, exp in small_factors:
        M *= (fac ** exp)
    
    print(f"[*] Solving DLP modulo M (approx {M.nbits()} bits)...")
    print(f"[*] Gap to bridge: {160 - M.nbits()} bits (Easy mode)")

    # 4. Recover Private Key
    # We have to try both Y solutions because square roots are annoying like that.
    rhs = (pow(server_pub_x, 3, p) + a*server_pub_x + b) % p
    y1 = pow(rhs, (p+1)//4, p)
    y2 = p - y1
    
    server_priv_key = None
    Qs = None

    for y_cand in [y1, y2]:
        try:
            Q = E(server_pub_x, y_cand)
            residues, moduli = [], []
            valid_subgroups = True
            
            # Step A: Pohlig-Hellman on the easy factors
            for fac, exp in small_factors:
                subgroup_order = fac ** exp
                cofactor = order // subgroup_order
                Gi = cofactor * G
                Qi = cofactor * Q
                try:
                    # 'operation=+' because Elliptic Curves are additive groups
                    d_i = discrete_log(Qi, Gi, ord=subgroup_order, operation='+')
                    residues.append(d_i)
                    moduli.append(subgroup_order)
                except ValueError:
                    valid_subgroups = False
                    break
            
            if not valid_subgroups: continue

            # Step B: Chinese Remainder Theorem
            d_part = crt(residues, moduli)
            
            # Step C: Brute Force the remaining few bits
            print(f"[*] Partial key found. Brute-forcing the gap...")
            for k in range(5000):
                cand = d_part + k * M
                if cand * G == Q:
                    print(f"[+] Found Server Private Key: {hex(cand)}")
                    server_priv_key = cand
                    Qs = Q
                    break
            if server_priv_key: break
        except: continue

    if server_priv_key is None:
        print("[-] Failed to recover key. Maybe the math gods are angry today.")
        return

    # 5. Decrypt the loot
    S = int(client_priv_key) * Qs
    shared_x = int(S[0])
    aes_key = long_to_bytes(shared_x ^ server_priv_key).rjust(32, b'\x00')
    
    try:
        cipher = AES.new(aes_key, AES.MODE_ECB)
        flag = unpad(cipher.decrypt(encrypted_flag), 16)
        print(f"\n[+] FLAG: {flag.decode()}")
    except Exception as e:
        print(f"[-] Decryption failed: {e}")

if __name__ == "__main__":
    solve()