False Witness

CACTF2026

Task: crypto oracle AES-ECB encrypts the flag under a random 256-bit key and leaks each key bit as either a random int (bit 0) or a public-key group element H(sk)=G^sk mod P (bit 1), with the player fully controlling generator G. Solution: pick G=P-1 (the order-2 element) so every PK value collapses to {1, P-1}, making the oracle a perfect bit distinguisher; reconstruct the key and AES-ECB decrypt.