看雪2020CTF 守株待兔

根据这句话，可以求分解曲线阶的最小公倍数即为整个曲线的阶

#n=37975227936943673922808872755445627854565536638199 * 40094690950920881030683735292761468389214899724061

#curve 1
M = 40094690950920881030683735292761468389214899724061
A = 0
B = 0x68ef17c5878742e629b88277f8b712506f899964098f94bc39b54e21a5493d961c69171ee03dc2df71L % M
P = (0x4B58435446323032302E7265616479752E43617463682E5261626269743A757365726E616D65 % M, 0x2177C13E81BEACB06B6D544BDFCA684BB07F6939D887CEC1AFCE2CA10E099A1C58 % M)
F = GF(M)
E = EllipticCurve(F,[A,B])
print ('ECC1:',E)
P = E.point(P)
ord1=E.order()
print ('ord1:',factor(ord1))

#curve 2
M = 37975227936943673922808872755445627854565536638199
A = 0
B = 0x68ef17c5878742e629b88277f8b712506f899964098f94bc39b54e21a5493d961c69171ee03dc2df71L %M
P = (0x4B58435446323032302E7265616479752E43617463682E5261626269743A757365726E616D65 % M, 0x2177C13E81BEACB06B6D544BDFCA684BB07F6939D887CEC1AFCE2CA10E099A1C58 % M)
F = GF(M)
E = EllipticCurve(F,[A,B])
print ('ECC2:',E)
P = E.point(P)
#Q = E.point(Q)
print ('ord2:',E.order())
P=E.point(P)
ord2=E.order()
order=lcm(ord1,ord2)

#curve
M = 37975227936943673922808872755445627854565536638199 * 40094690950920881030683735292761468389214899724061
A = 0
B = 0x68ef17c5878742e629b88277f8b712506f899964098f94bc39b54e21a5493d961c69171ee03dc2df71L
P = (0x4B58435446323032302E7265616479752E43617463682E5261626269743A757365726E616D65, 0x2177C13E81BEACB06B6D544BDFCA684BB07F6939D887CEC1AFCE2CA10E099A1C58)

F = Zmod(M)
E = EllipticCurve(F,[A,B])
P=E.point(P)

print ('ECC2:',E)
print ('ord2:',order)
print('P:',P)
print('P:',(order+1)*P)

Base=inverse_mod(257,order)*P
print('Base:',Base)
#after calc base
print("verifying P:",Base*257)
x,y,z=str(Base).replace('(','').replace(')','').split(' : ')
x=int(x)
y=int(y)

print("flag{username-"+hex(x)[2:-1].upper()+'-'+hex(y)[2:-1].upper()+'}')
#flag{username-27D9A3DACA0B408853CBB1D79393864648F4DEA917066285C182C8B717A6822D9B67A541F173F75DB88-12C1975E404FA3E9356E6492BC2934E889F63FE98B623B83770CCFE519EFD5A9F5D0C1DB43A0F61D2BF}