CTF writeup: SageMath has a modest workload in HSCTF 2020's Extremely Complex Challenge: recover an elliptic-curve parameter, then solve a decidedly small discrete log.
We are given two points on an Elliptic Curve, its order and parameter b.
Using these quantities, we can recover parameter a.
Plain text
1
2
3
4
5
6
7
8
9
y^2 = x^3 + ax + b (mod p)
y^2 - x^3 - b = ax (mod p)
If we have two points on curve, (x1, y1) and (x2, y2), we can get
(y1^2 - x1^3) - (y2^2 - x2^3) = a(x1 - x2) (mod p)
a = (x1 - x2)^-1 (y1^2 - x1^3) - (y2^2 - x2^3) (mod p)
(x1 - x2)^-1 is inverse of (x1-x2) modulo p
Now as we have all parameters, we can solve ECDLP easily since the sizes are too small.