Meet me in the Claw (meet_me_claw)

cryptohack

Task: an SIDH instance (p=2^35*3^29-1) where Alice publishes only her public curve EA (codomain of a secret 2^35-isogeny phiA:E0->EA) but FORGOT to send the torsion images phiA(P3),phiA(Q3); Bob's secret sB is given. Recover the shared secret and decrypt. Solution: claw-finding meet-in-the-middle on the 2-isogeny graph — walk d1=17 two-isogenies from E0 (dict j->path) and d2=18 from EA until j-invariants collide at a meeting curve E_mid, recovering Alice's secret 2^35-isogeny path. Push P3,Q3 from E0 to E_mid, then back to EA via the DUAL of the EA-side chain, bridging the two equal-j-but-different Weierstrass models with an isomorphism (x,y)->(u^2 x, u^3 y) at each step (otherwise point order corrupts from 3^29 to 3^28). Build Bob's kernel phiA(P3)+sB*phiA(Q3), take the 3^29-isogeny, j of the codomain is the shared secret. Done in pure Python, no SageMath.