A Suspicious Generator
An active attacker swapped the generator before the exchange completed. The shared secret only has two possible values now.
A man-in-the-middle intercepted a Diffie-Hellman exchange and substituted a malicious generator with order exactly 2, before either side computed a shared secret. Whatever secret resulted, it can only be one of two possible values — regardless of either party's actual private exponent.
The flag below was XORed with that shared secret (reduced to a single byte). Try both candidate keys.
1000000007
1000000006
6565727d756b326a6a59757364617436737659653668603768636b6368727b
Hints
Checked entirely in your browser — nothing you submit here leaves your device.
Background on this technique
Up next
Recover the Signing Key →A toy elliptic curve, a public key, and the private key that produced it — small enough to brute force by hand.