CRY (909 points, 2 solves)

Here we explain the intended solution for the cryptography challenge alcoholic_variety from our recent CTF.

The goal of the challenge was to solve a discrete-logarithm problem on a mysterious abelian variety given in terms of its addition formulas in a high‑dimensional projective space over a finite field.

The task consisted of a simple Python script vuln.py, which implements a standard double-and-add ladder for scalar multiplication in an (additive) group and asks the user (i.e., you!) to compute the corresponding discrete logarithm in no more than 10 minutes:

#!/usr/bin/env python3
from formulas import p, zero, base, add

def normalize(P):
    i = next(i for i,t in enumerate(P) if t)
    s = pow(P[i], -1, p)
    return tuple(s * c % p for c in P)

def scalarmul(P, n):
    if n < 0:
        raise NotImplementedError('need n ≥ 0')
    assert n >= 0
    R = zero
    while n:
        if n % 2:
            R = add(R, P)
        P = add(P, P)
        n >>= 1
    return normalize(R)

if __name__ == '__main__':

    import signal
    from random import SystemRandom

    signal.alarm(600)

    sec = SystemRandom().randrange(p**2)
    pub = scalarmul(base, sec)
    print(f'{pub = }')

    sol = int(input(), 0)

    if not 0 <= sol < p**2:
        exit(1)

    chk = scalarmul(base, sol)

    if chk != pub:
        exit(1)

    print(open('flag.txt').read().strip())

The real core of the challenge, however, is a 2 MB Python file formulas.py, which looks somewhat as follows (with very repetitive parts omitted):

p = 0xec5978da7a46c1326123bddc340f0b51710706df

zero = (0xd5af0a603bac4b7df48d3ffd8fe639c56ffc9d57,
        0xaed2f6c8924a9a1f3a359dbc9f81565498af33af,
        0xbcb00b0ffee956e0b2d33ec0390608a502b61b74,
        0x22e96142b6d8da90a64e23d44b8946b6de71dbb8,
        0x7c171230237fa95f8ff370d4539ab84ea6c1cccc,
        0x30b85f272ca471c432ebd67ae30d278b626ba9a6,
        0xadfbf5a4ae2a552df3155ec4ab36ca96b459e5be,
        0xe9837e1b92b7c8838e1828183afa8d05fa1a5114,
        0x0674fc52377bfd50f73a8046aeb7b0da717f53ea,
        0x9897cd93f4d283509d7b7daa5ea1c23d563eab19)

base = (0x94ceff6f8cbf27c6684482fea57430a894909028,
        0xbccae74d17a2ba2997971950e9e1b1bed562150e,
        0x94ebe75f062be606c3cd43ade933d0b5b09ce011,
        0x3422a90ba5288fbd00aacd4ed498d6f4aea9582f,
        0x09562979959acebc3b31ba716e4286e2fde45ba2,
        0x83e067df56eb12c1fcd90e92c70e0013d809692d,
        0xafc9eedaea605266bee376cea3619b91f678bbf3,
        0xe99a10c4be05090dec373ebb30ff189bb6804fff,
        0xbfbc2466baf094118a424359b4cbcf3a1d306111,
        0xc463631e7d1b4a8d505384555337e77b9d0549b0)

def add(P, Q):
    X0, X1, X2, X3, X4, X5, X6, X7, X8, X9 = P
    Y0, Y1, Y2, Y3, Y4, Y5, Y6, Y7, Y8, Y9 = Q
    T00 = X0 * Y0 % p
    T01 = X0 * Y1 % p
    T02 = X0 * Y2 % p
    T03 = X0 * Y3 % p
    T04 = X0 * Y4 % p
    T05 = X0 * Y5 % p
    T06 = X0 * Y6 % p
    # ... 86 lines ...
    T93 = X9 * Y3 % p
    T94 = X9 * Y4 % p
    T95 = X9 * Y5 % p
    T96 = X9 * Y6 % p
    T97 = X9 * Y7 % p
    T98 = X9 * Y8 % p
    T99 = X9 * Y9 % p
    S0000 = T00 * T00 % p
    S0001 = T00 * T01 % p
    S0002 = T00 * T02 % p
    S0003 = T00 * T03 % p
    S0004 = T00 * T04 % p
    S0005 = T00 * T05 % p
    S0006 = T00 * T06 % p
    # ... 3011 lines ...
    S9699 = T96 * T99 % p
    S9797 = T97 * T97 % p
    S9798 = T97 * T98 % p
    S9799 = T97 * T99 % p
    S9898 = T98 * T98 % p
    S9899 = T98 * T99 % p
    S9999 = T99 * T99 % p
    Z0  = 0x5eb3705ee948c25660e2bf8781a1dbf6c54a6bdb * S0000
    Z0 += 0x3fed1b949b315aef4ef4021c37edba708b9a6919 * S0001
    Z0 += 0x8a49fca770fdcc94c153d9c95cada504c13ca728 * S0002
    Z0 += 0xdf18ac6aa579b3ddc469eb6dd55d6ff5f1ee8099 * S0003
    Z0 += 0xa044cc9fa6d3971b93c3c1f1362c5b7e05da768a * S0004
    Z0 += 0xbdd4d28436618883661c51121a7d47b790673a4a * S0005
    Z0 += 0x4c9b2664c105e5a14286d1e4fb243c5055db5ee4 * S0006
    # ... 30236 lines ...
    Z9 += 0x8532fec828171f9fd6344fb42e4bb2d0e1972d24 * S9699
    Z9 += 0x181683aa3525855f8820674b38c8ee57cf61dc29 * S9797
    Z9 += 0x2b5c0febfca2d76024c7254435a2b862ef0022b6 * S9798
    Z9 += 0xaea3dd4296bd44e99cb67e8989876f0aec93da20 * S9799
    Z9 += 0x9dff3205bcf62f918b74e847a74ac79e8d3a91a1 * S9898
    Z9 += 0xb03aed7719cbdd5e072d6b0aa1753001f9b902d0 * S9899
    Z9 += 0xc14cba37285934d5abddd96fbc463c8ffdf9d2ac * S9999
    Z0 %= p
    Z1 %= p
    Z2 %= p
    Z3 %= p
    Z4 %= p
    Z5 %= p
    Z6 %= p
    Z7 %= p
    Z8 %= p
    Z9 %= p
    return Z0, Z1, Z2, Z3, Z4, Z5, Z6, Z7, Z8, Z9

What's going on?

Judging from the normalize() function, it does look like we are dealing with a projective situation: Rescaling all the coordinates by the same constant yields the same point. Therefore everything "lives" inside of the 9‑dimensional projective space $\mathbb P^9$ over the finite field $\mathbb F_p$. Moreover, it can quickly be verified that add() indeed performs an operation that behaves like an addition (associative & commutative), with neutral element zero.

Therefore we are dealing with an abelian variety, which is the proper name for algebraic varieties carrying an algebraic group structure. The instances of this concept that are the most familiar to CTF players should be elliptic curves and Jacobians of hyperelliptic curves. In this case, however, the given abelian variety looks nothing like those more standard cases: Indeed, all we have is the zero point, a base point, and an addition formula, but not even the equations for the variety are given.

Solution

From a high-level perspective, the (intended) solution proceeds in three individual stages:

• Compute defining equations for the variety in question. This can be done by generating a number of points (using base and add()), guessing the degree of the variety, and solving for the vector space of coefficients of multivariate polynomials of the target degree so that all the known points are zeroes of those polynomials.
  When this step is completed, it will have transpired (e.g., by computing the dimension of the resulting ideal in Sage) that the variety under investigation actually does have dimension one: It is a curve!
• By one of the definitions of "elliptic curve", we therefore know that the "alcoholic variety" actually is an elliptic curve; it's just embedded in an excessively high-dimensional projective space. Therefore the goal has become to find a map from the given variety to a standard elliptic curve in (short) Weierstraß form, where the given DLP will become more approachable. This is conceptually "easy" according to the kind of people who enjoy thinking about schemes (imitate the standard proof that every smooth genus‑1 curve embeds into the plane by computing Riemann–Roch spaces), but sufficiently general implementations of this procedure are unfortunately a bit scarce.
• Finally, solve the DLP on the elliptic curve in $\mathbb P^2$ using standard techniques. The particular elliptic curve here allows for solving DLP by solving modulo the smooth part of the order directly using Pohlig–Hellman/baby‑step-giant‑step, and using a pairing (MOV attack) combined with a finite-field DLP solver (e.g., CADO‑NFS) to recover the solution modulo the non-smooth part.

Finding the variety

...involves looking for multivariate polynomials that vanish simultaneously at all known points of the variety. Since we have the addition formulas and a base point of presumably large order, sampling lots of random‑ish points should be easy: Simply start from zero and keep add()ing the base point to it to obtain a large number of points.

The multivariate polynomials in the coordinates of $\mathbb P^9$ that vanish on all those points then evidently form a vector space. It can be computed as the (right) kernel of the matrix \[ \begin{pmatrix} M_1(P_1) & M_2(P_1) & \cdots & M_r(P_1) \\ \vdots & \vdots & \vdots & \vdots \\ M_1(P_s) & M_2(P_s) & \cdots & M_r(P_s) \\ \end{pmatrix} \,\text, \] where $M_1,...,M_r$ are the monomials $X_0^d,X_0^{d-1}X_1,X_0^{d-1}X_2,...,X_0^{d-2}X_1X_2,...,X_9^d$, etc., in the coordinate functions $X_0,...,X_9$ of some degree $d$, and $P_1,...P_s$ are a list of points on the variety. That is what the following script does:

#!/usr/bin/env sage
proof.all(False)

from formulas import p, zero, base, add

F = GF(p)

projdim = len(zero) - 1
Us = PolynomialRing(GF(p), 'U', projdim+1).gens()

print()

mons = {Us[0]^0}
for deg in range(2):    # increase degree until dimension of variety stabilizes
    mons = {m*u for m in mons for u in Us}
    print(f'deg {deg+1}:', len(mons))
mons = sorted(mons)

mat = matrix(F, len(mons) + 11, len(mons))
pts = [zero]
for i in range(mat.nrows()):
    mat[i] = [mon.subs({u:c for u,c in zip(Us,pts[-1])}) for mon in mons]
    pts.append(add(pts[-1], base))
    print(i, '/', len(mons), end='\r', file=sys.stderr)
print('\r\x1b[K', end='', file=sys.stderr, flush=True)
print('dims', mat.dimensions())
print('rank', mat.rank())
print('ker', mat.right_kernel_matrix().nrows())

lat = mat.right_kernel_matrix()

vareqs = [sum(s*mon for s,mon in zip(row,mons)) for row in lat]
vareqs = sorted(vareqs, key = lambda eq: (eq.degree(), eq))
varidl = Ideal(vareqs + [Us[-1]-1])
vardim = varidl.dimension()
print(f'{vardim = }')

The degree $d$ is a priori unknown, but we may simply start from $d=1$ and continue increasing the degree until the resulting dimension of the variety stabilizes. At that point it is extremely likely that the set of equations that have been found are actually sufficient to describe the variety fully. In the case considered here, the dimension actually becomes $1$ as soon as $d\geq 2$, and we know that the dimension cannot be smaller than $1$, so we are done with $d=2$.

Finding a plane model of the curve

Now, the next goal would be to find an isomorphism from the variety we just recovered to some plane projective curve, where we then should be able to apply all the usual elliptic-curve techniques: Point counting, pairings, and so on and so forth.

The bad news is that there seems to be no good support (yet 😉) for doing any of this in Sage at all. Implementing the required Riemann–Roch basis computations to recover coordinate functions which map into $\mathbb P^2$ in an ad‑hoc manner for this situation is presumably possible, but in general all this is pretty difficult (both conceptually and in terms of coding).

However, the great news (to those who realized) is that Magma simply implements the required transformation as a part of its EllipticCurve constructor, which will accept an arbitrary projective curve of genus $1$ with a rational point and turn it into a Weierstraß curve. We thus augment the Sage script above with some Magma code generation:

if vardim != 1:
    raise NotImplementedError('only curves (dimension 1) currently supported')

print('\x1b[34m', file=sys.stderr, flush=True)
print(f'F := FiniteField({F.cardinality()});')
print(f'P := ProjectiveSpace(F, {projdim});')
print(f'R := CoordinateRing(P);')
print('I := ideal<R | [')
for f in vareqs:
    ff = str(f)
    for i in range(len(Us)):
        ff = ff.replace(f'U{i}', f'R.{i+1}')
    print(f'    {ff},')
print('0]>;')
print('C := Curve(P, I);')
print(f'P := C ! [{", ".join(map(str, zero))}];')
print('E,iso := EllipticCurve(C, P);')
print('E;')
print('iso;', flush=True)
print('\x1b[0m', file=sys.stderr, flush=True)

################################################################

# now we walk over to the Magma calculator and submit the code
# ...and save the result in magma-out.txt

Running the script with the given formulas.py from the challenge results in the following Magma code:

F := FiniteField(1349317116055496347935183323829721306283718936287);
P := ProjectiveSpace(F, 9);
R := CoordinateRing(P);
I := ideal<R | [
    29830562404848311145712139164506172374259834398*R.1^2 + 1336251824171414208349020539304861123903934408776*R.1*R.2 + 209038896513545714512098103026900486176800148718*R.2^2 + 573790199447475445616478090288529745756089423942*R.1*R.3 + 398665493153286676780804698965146779416996393293*R.2*R.3 + 283061061564636760456559375248766501364996175335*R.3^2 + 1141441892738663693259507135523103373309933374420*R.1*R.4 + 955056702211617852528576934685633098436724933279*R.2*R.4 + 816375191408734768252391399262975207332528729678*R.3*R.4 + 173102599748791768799845414687267125555029970809*R.4^2 + 1052593594928081428134897760061192720320238216152*R.1*R.5 + 221461570748438120336396946764728306555292085461*R.2*R.5 + 317519551529446870928991875472739764007381181619*R.3*R.5 + 407851724297054135376941700497337023745013542591*R.4*R.5 + 342460556510184901144620296902218425008139720828*R.5^2 + 889662776995006404337695627688874002997215141393*R.1*R.6 + 431858747604764263404832719946285934577403808441*R.2*R.6 + 677212288691199711065871308027988382991952110460*R.3*R.6 + R.8*R.10,
    141961724335824952429347980847501776737614506448*R.1^2 + 1188324356814186731490376360300254005776497148874*R.1*R.2 + 663893104088406280772628028990963229717747393488*R.2^2 + 288435349233290371076422925453603105061353172132*R.1*R.3 + 1191721339629021982312546806470042847367117405238*R.2*R.3 + 1175247884833162945933116073433798543958715812278*R.3^2 + 573916557099016154982520377848758300151957920196*R.1*R.4 + 555758816571758679012619887335894455097797954665*R.2*R.4 + 25831586502188163412224316551827029356384620215*R.3*R.4 + 148248316132016004586355712167243190860589986339*R.4^2 + 529218617823976873953800341854595743148155267548*R.1*R.5 + 168157314257930502657643378359887166651834601835*R.2*R.5 + 1072031823176037691250913935323327662450149870376*R.3*R.5 + 644596092477571230734265326550963284346520546713*R.4*R.5 + 447887153218463686728855798003999352665639722894*R.5^2 + 270268462455299104234073499845677538261350422186*R.1*R.6 + 380512132639843649700726174264453756999096112935*R.2*R.6 + 751808693790136954713894690495393923805465417862*R.3*R.6 + R.10^2,
    149261138210871966234261094454678621229988328825*R.1^2 + 1008453981397719335936475356149789787664277436713*R.1*R.2 + 980339705451863468795878138017592774002563060703*R.2^2 + 517113097781530690403525842621761154634624890867*R.1*R.3 + 234433159726423325502079175937151872575611420375*R.2*R.3 + 1232898413642010337375030057091579059647350811562*R.3^2 + 45734501055196162449705196670242043391751066982*R.1*R.4 + 1278819423706607310546238334166186552432120553799*R.2*R.4 + 529471940197771238668970002613683461247451823224*R.3*R.4 + 60699387606889957128759595067285095329004399507*R.4^2 + 1212660426528469006123063457205011023067879202572*R.1*R.5 + 1200047150102722652732579750344157178449686976711*R.2*R.5 + 79382351758128266815259629165111752347232974565*R.3*R.5 + 230916315289081237246581563196154520731909836497*R.4*R.5 + 928966229854503948952507270789486293375372226947*R.5^2 + 209500497400771112841261100949052495876412745978*R.1*R.6 + 366944069533864609898385039195064994611169720738*R.2*R.6 + 380285482695571933713728892519274765863161444210*R.3*R.6 + R.9*R.10,
    164923053390500067640984909165024441793204147944*R.1^2 + 1002472973178161838710188232581238227642850378740*R.1*R.2 + 272975881330134146896219894670406486208815561376*R.2^2 + 902855423020656839026607877236842597448241468472*R.1*R.3 + 549761257464646337657947362726516054575917916178*R.2*R.3 + 1012428872913362533958325393161228890416818707389*R.3^2 + 403621401118016336490491446644810800141365831384*R.1*R.4 + 620075581729423471916194180938379572950081897212*R.2*R.4 + 1332378584419717317965896672791479716871402943184*R.3*R.4 + 248799132096521556098809311474348337194200332876*R.4^2 + 1255058574565484627127181641093195888581862265094*R.1*R.5 + 389934152480011139774819496661851042022098398829*R.2*R.5 + 592685790131087693379838560532067258054259031114*R.3*R.5 + 211254024083247403858571051571386251672145329600*R.4*R.5 + 524876409671986901760822217713379111072033066592*R.5^2 + 1159466985978586981857585986037956903751332498277*R.1*R.6 + 782099567820800855326890009614725530913889165975*R.2*R.6 + 1066772734697171088917327784183993332635022786398*R.3*R.6 + R.4*R.7,
    189886872989913067003378989559959395826874341827*R.1^2 + 40020498508219478975003337522700862753336416510*R.1*R.2 + 1115519426165546234982725610499743647935590199983*R.2^2 + 769673855415151424951041469141356680448151734212*R.1*R.3 + 712360588837350227407498778639312031443700486626*R.2*R.3 + 704709816799294206398656247489824111848140677943*R.3^2 + 468830143287308002682784701105198812114813721975*R.1*R.4 + 321012546611778402120592504688887584403586770470*R.2*R.4 + 642997560612767512580689795958661665617098774150*R.3*R.4 + 422706557629303724438815958777721531497655515440*R.4^2 + 1344057981385246383399975172698055792856498122804*R.1*R.5 + 378795713471830186390778271878802883640310843378*R.2*R.5 + 1279436060360961407640218770766782959561255849565*R.3*R.5 + 252959477486616068279238347051250468223002626093*R.4*R.5 + 923945356162272789310307066869469348326051345869*R.5^2 + 883461832527769306034218326062026351710338983999*R.1*R.6 + 573695391430417331607584215309907747596766287610*R.2*R.6 + 471148609965677098501745250353216360240373140537*R.3*R.6 + R.6*R.10,
    196152160048572121002582995245775665554190877004*R.1^2 + 840715169114295085343703331700035866609298292333*R.1*R.2 + 963657957565302515592825795908569968089451794538*R.2^2 + 1153819032608566894890113954017831101642617387612*R.1*R.3 + 521278969319471775039983147330581829650503674416*R.2*R.3 + 728465966378169263930099373074395651099044200874*R.3^2 + 164449713974687641652867899952042434806111277835*R.1*R.4 + 917889175257457302774451730619780194632015612487*R.2*R.4 + 494239764986972888155688969904925517329390026336*R.3*R.4 + 805032895039695668487835730299212353947589501778*R.4^2 + 338512675380634269811041250417648729156086966302*R.1*R.5 + 28268554160409790081626466135364487754789658681*R.2*R.5 + 44827686474125222445423996077576562745703028509*R.3*R.5 + 1185949457434847040729163104028017946727256691513*R.4*R.5 + 46426329574667025688132460375147868190078207743*R.5^2 + 1321574128206935389365669708000686168390946782700*R.1*R.6 + 417401739377259361159231967227131029472361991772*R.2*R.6 + 442189642900736793839629487019759390397419004171*R.3*R.6 + R.5*R.6,
    213273381986420823436787240209779657509988229392*R.1^2 + 355457578635342456497985803011850163611389105485*R.1*R.2 + 653732765855873571683557090168292829416969596075*R.2^2 + 770511386469147982482332307195609209594633976631*R.1*R.3 + 14075214586034824002621413960356679329556004313*R.2*R.3 + 1097227121321329567482872674361459261308844298294*R.3^2 + 966365127766001986877659657525732073407940606625*R.1*R.4 + 637483161525155550693524261005681693737633486613*R.2*R.4 + 1260355222168052864401976565261100512557384539225*R.3*R.4 + 237662795166156289889599177719871014369785325904*R.4^2 + 242503847652335923422354745574190005492227754250*R.1*R.5 + 241410029894378331814460102388063017663873361588*R.2*R.5 + 354449205460721399976472139254545258828493062167*R.3*R.5 + 1044994311177921039349341738768009550862106810768*R.4*R.5 + 148208564893267247558384407122212554307239646822*R.5^2 + 174012434446643644552400037270204202021022442397*R.1*R.6 + 1334694175023614423570631101052642065906394437676*R.2*R.6 + 1170448647727514583485398419054331891413889803861*R.3*R.6 + R.6*R.7,
    230570195104769053855326559925036706774512092994*R.1^2 + 1075524683603455097628220211419300390279678704308*R.1*R.2 + 742814640275493268449138130012530076035978538295*R.2^2 + 932559050840177900155434428401462038176511297755*R.1*R.3 + 982392034935543899584714484404385596873581517129*R.2*R.3 + 355761291944725985761792232428260469932877336681*R.3^2 + 705073431550592043963069872456843366299078665816*R.1*R.4 + 1199494808453354979126557572517650760860920194985*R.2*R.4 + 1333070067472925725118413819375020497738594271325*R.3*R.4 + 1119656247340782190763573902236405327547164320682*R.4^2 + 995446051602267261336444117916847928251993398338*R.1*R.5 + 735647505253621852424023555703129539023605461637*R.2*R.5 + 413426373669245494294176906476801179688131329482*R.3*R.5 + 1316570628666548986876721664772622376379151011653*R.4*R.5 + 706805858201700464057146835810319914077128955608*R.5^2 + 1322802063740657979305497177816032941234211335282*R.1*R.6 + 269121424959455366305223989309089587115855138280*R.2*R.6 + 156669202327670753270381200326975636756037160694*R.3*R.6 + R.4*R.6,
    232106254476221211597835348364172875481690028383*R.1^2 + 584287111406795372757432234979482846759430505451*R.1*R.2 + 1297324506056383984242713619939092722303311028318*R.2^2 + 1003122620864623505145851146798866912632687738020*R.1*R.3 + 499060783225051711270322671743601828882992212789*R.2*R.3 + 588261593412799314462111166654849492550770023363*R.3^2 + 1119940193424631051659658869822203684953710212802*R.1*R.4 + 453246801953209967303842559633901414580081093641*R.2*R.4 + 549071526345737948649533651523975567194036022364*R.3*R.4 + 1204137715465904762321285097572350961243982303387*R.4^2 + 572242803601954330784772382546355943291520818879*R.1*R.5 + 1271190258765520509575229072385611585532758758357*R.2*R.5 + 393664840827107094412763240062331535344892642142*R.3*R.5 + 1166754836956113884469025272299614039877595414975*R.4*R.5 + 999142457717203154022645596845593187400014386570*R.5^2 + 1337606444827924310963475779381530332293328408367*R.1*R.6 + 591492795809418262767953479226729528566926342548*R.2*R.6 + 1117506914012459018494621051446657868015290392912*R.3*R.6 + R.2*R.9,
    282523201618343237855275501735285707957230708599*R.1^2 + 206907711494223461048455873294107656639028322999*R.1*R.2 + 825142764480342252008090858723492861493088071225*R.2^2 + 802414075615750204801349088280073370805240033493*R.1*R.3 + 687025093468094256000346068286201468037962784467*R.2*R.3 + 1336713458373926068085099021475968155166225461408*R.3^2 + 426420868353164145015789307530836175892804535761*R.1*R.4 + 57224227335842554916246196018462266659976303079*R.2*R.4 + 34000971886115624000334688482279201407270319519*R.3*R.4 + 578062691695585935670475844748462333334974083632*R.4^2 + 429181874214322377681721536151606515033192097326*R.1*R.5 + 1049661094063500463854685282026572867381248529958*R.2*R.5 + 524089002831965289370004595954541339589103332187*R.3*R.5 + 771262959043195588684679919650542941453447755550*R.4*R.5 + 942295391984977733554412078304232917455477591105*R.5^2 + 870580376364818725809500063905630995406132661162*R.1*R.6 + 91461886025549588845445866881962556338682906719*R.2*R.6 + 179143898125352068857907996865669357959664477324*R.3*R.6 + R.8*R.9,
    336737981187979845259991387731921018905889837086*R.1^2 + 960390233526815962280340286934238981441289911434*R.1*R.2 + 343747958163442675192395689511891796353459395723*R.2^2 + 523207242520598929787170406034753902968138790894*R.1*R.3 + 525311992431662580438881180622359856500934769740*R.2*R.3 + 758529248649017991336123969093380885191993176847*R.3^2 + 1299283253019448137004905038047944706551396082168*R.1*R.4 + 984395990154274286557803377885960179478265906047*R.2*R.4 + 1142383814262716319970956997097674002047828499759*R.3*R.4 + 1094028070820145209872422757792693301000771079322*R.4^2 + 170352256927332454401841446557719172864076236193*R.1*R.5 + 1036141976609373507869405972140386280661523346331*R.2*R.5 + 298646944245431146983767490427951601713536937958*R.3*R.5 + 924860716608163357431869112642839293569473098372*R.4*R.5 + 846134493151550653452204796306826237030065713286*R.5^2 + 467473502110904691501117718848229569486959520675*R.1*R.6 + 879966885945268022293244910155898103179712807683*R.2*R.6 + 34299454691618521429303345703554360785882570590*R.3*R.6 + R.7*R.8,
    372760092111345351771541754567167797950249695185*R.1^2 + 831249634518943425619830557242518021302381176566*R.1*R.2 + 98972879141300436757410844956302200280030389253*R.2^2 + 1037551063660759891155174463186461687050814956140*R.1*R.3 + 979812667141463514399953426262637169519727727475*R.2*R.3 + 642791862716876331505837358408021294912890236662*R.3^2 + 1137169102559041483447242195482933234351349453769*R.1*R.4 + 912782516273533656910223237888776939724364809608*R.2*R.4 + 931457767782650819606519811725420716753608169062*R.3*R.4 + 1338245245329178331724698245603877663469156620091*R.4^2 + 1165216719422568312880435542613461315651103803183*R.1*R.5 + 493500764141673691275334714909243552669598403820*R.2*R.5 + 133430672836014359537454112218537154840229782548*R.3*R.5 + 454088753752432723659016711425523273099279140919*R.4*R.5 + 34765753487288826224461834408792623965079673264*R.5^2 + 456109483755348872191803505218956969175323324221*R.1*R.6 + 1284337432776748941646391124905878257798593315369*R.2*R.6 + 507032958490376711417419530616787045208246202073*R.3*R.6 + R.7*R.10,
    455337542472299164125501457290540441614737392607*R.1^2 + 348286670235844933109058803451865666384492767064*R.1*R.2 + 900705221539842377466130582166433366979894080870*R.2^2 + 72532271705515795754751323400771822686501816980*R.1*R.3 + 649556072365791915796680050018236297159651271330*R.2*R.3 + 398061156287630875469766788781600435983469577973*R.3^2 + 554987186290772276906878600922407514500751645716*R.1*R.4 + 360382047605832672192361855157463308565846135374*R.2*R.4 + 1197653964743227349729034788781310063082680636297*R.3*R.4 + 332410342414402789657114419787799049223634237737*R.4^2 + 801249432695390951609534799026442342234900842726*R.1*R.5 + 39327909701042377650964841975968993030549875625*R.2*R.5 + 1008768131174853125680451583682821776321547608378*R.3*R.5 + 138104169482055724066830314198916687825809424020*R.4*R.5 + 758880429647618445101147370361054801401868043640*R.5^2 + 278384362693479230807894497302385283625769813748*R.1*R.6 + 1251810340816359378133901973748044912535027703591*R.2*R.6 + 474894435799429346412154786546938521369123279290*R.3*R.6 + R.4*R.8,
    462384555619213926557402634843033268569618833276*R.1^2 + 217930333105727815682215945272883434081446105095*R.1*R.2 + 735792196736091855103544954305194732579583308249*R.2^2 + 109528015297783476445633909294176244164530943163*R.1*R.3 + 923135563082178288613475274816109249471439543733*R.2*R.3 + 1099120907039434412940770658855120149604541517737*R.3^2 + 532886837648682739508680368667781329929177630721*R.1*R.4 + 1269768765189134166000783067518167015036250088479*R.2*R.4 + 223247378981203767820827376281276229004390388133*R.3*R.4 + 790540898449996764940620329910044124627299236798*R.4^2 + 1005384945223727274039362145905640615908114153071*R.1*R.5 + 992267022899061928906235899739510605887531187727*R.2*R.5 + 1026543854528397563691284827153736050095463113223*R.3*R.5 + 161743202404356306593034918535739610680154859154*R.4*R.5 + 240745217959314950167407636891341756964511120569*R.5^2 + 498582230269544871698883917440500171698110997599*R.1*R.6 + 361302584632108312823582359433855442273911888939*R.2*R.6 + 880021093553141760545798041269234708588662060431*R.3*R.6 + R.3*R.9,
    482721048875724196878566549002616786102994126541*R.1^2 + 1182466443545562799656448468862824056995281996318*R.1*R.2 + 191427708057520273382323617581630586067944671273*R.2^2 + 536417944519291670820532537592199102867004831394*R.1*R.3 + 1326065355340238105898187947345185361877599163204*R.2*R.3 + 883083963029990303080941041213658314019487938521*R.3^2 + 337099607774275918179568544496030103777527767796*R.1*R.4 + 729925386259696860299928361969388520591535200533*R.2*R.4 + 97144794770561675463682610960529595840638227721*R.3*R.4 + 1098263666097360095741240066976726479008126233478*R.4^2 + 145531041585493933147828464194245633704556018613*R.1*R.5 + 599613660735772679404994157489522239228697233104*R.2*R.5 + 864598896495730483485704351331685469682970449139*R.3*R.5 + 387890876942580647455284735143623585557565289491*R.4*R.5 + 1288815080720353608182331419973806057441462507719*R.5^2 + 579221690415178455410384404094665917627091810513*R.1*R.6 + 399398993139007374242339711625231663399846199583*R.2*R.6 + 669593274400803117497543834817537243050790666834*R.3*R.6 + R.3*R.8,
    599990377111008588611263295299965535329352506155*R.1^2 + 237607542401572711064634602184636937391543617685*R.1*R.2 + 1259262528272033171599095054450791651283322087944*R.2^2 + 616935127986263677464159695360349225769671470192*R.1*R.3 + 182150457753176883058951065843313381539995138171*R.2*R.3 + 586883755657310097006501254547118083344071118764*R.3^2 + 532312522884483980734832712778222615138741870105*R.1*R.4 + 1334917078079452052105333546237351413952969831948*R.2*R.4 + 270863380106627535976434577646287331713411408947*R.3*R.4 + 1203176186688842740965820241254476540307026102886*R.4^2 + 986408569308493380016142470894518858889948536221*R.1*R.5 + 758589617246587130915146344882802885151113746776*R.2*R.5 + 967539305912108334245199619767343576678561882567*R.3*R.5 + 1195609529428117213042729220736902490004696725348*R.4*R.5 + 841710335992095564214462619725766287948275451258*R.5^2 + 396509393684901781452611464596482128041940289343*R.1*R.6 + 79585657435514581872538643233822014522216903088*R.2*R.6 + 1241287146134482576076786512203213625277602186108*R.3*R.6 + R.2*R.8,
    620919175991991660944048917862282526091868273958*R.1^2 + 282097621066485606162295478031585004116695133883*R.1*R.2 + 1017034842296759809717704694782882827947151994567*R.2^2 + 1242120935265311859391157986543573992489917560217*R.1*R.3 + 62849097820586600399823910501527345271952407512*R.2*R.3 + 519551808322550864960256269670259560071905117531*R.3^2 + 1339382472741397090399114566673324985381108460981*R.1*R.4 + 517356982154421783878711663933007770451448020875*R.2*R.4 + 196483774308006377220993477923321287644564215158*R.3*R.4 + 133376929989316037899249128078792807855728848282*R.4^2 + 1105308238588675099194595072267436243602318435288*R.1*R.5 + 1122600893172324484074495390340506080511767461407*R.2*R.5 + 1324423458569858278815265478803575134534472065275*R.3*R.5 + 1021746176448638672030639517023937205748135736612*R.4*R.5 + 1279783974700717599898387818753927275474151242646*R.5^2 + 655597717275745213829154604167956381503263294084*R.1*R.6 + 112391125635899545581940633491006274183198067086*R.2*R.6 + 234000124136961628891410931296139749405347393178*R.3*R.6 + R.6^2,
    673256628268477779622010668403702303008042076453*R.1^2 + 405567193442259953620197293163453388175145597447*R.1*R.2 + 614607517081059511389689663706670373128821185224*R.2^2 + 565504111229070978847110411241469832584285698152*R.1*R.3 + 55458012360386717551174063127101215647219848297*R.2*R.3 + 178159241312950912189447571929667938811988923347*R.3^2 + 138245231807041046764951953051813971276127371242*R.1*R.4 + 315039797344832701519486805671072969276363593275*R.2*R.4 + 1069681701877542720740329372881956515345190071215*R.3*R.4 + 22298731247566919711058698882920400467174423086*R.4^2 + 928572918258651772336247983695645101988798909040*R.1*R.5 + 861921356726601129659880655421080417565994987725*R.2*R.5 + 236454480163456743186197258414484704020268146699*R.3*R.5 + 528955564463182737362172421516354607379890074696*R.4*R.5 + 550416092887465772855440760196198872788906418223*R.5^2 + 1283187799931082792792029111652084055939298417490*R.1*R.6 + 1331605687981712617172883253902597055268968510198*R.2*R.6 + 992363728813394279713982987545593711320664488547*R.3*R.6 + R.8^2,
    735714089923056854057803290995631214281336505710*R.1^2 + 1325706825845223998150447426505693508666086555950*R.1*R.2 + 97843706002262552262517619998942156362949912795*R.2^2 + 295144349185225144882594048415639613706183050999*R.1*R.3 + 35265374831105131281532207943662617488556032770*R.2*R.3 + 1238312589878123764483972321325778646161568183711*R.3^2 + 615052128674097026173084107977320438803422284746*R.1*R.4 + 827872592659685369436229695134816122788968479905*R.2*R.4 + 733799129979084790152281345098558019697379399136*R.3*R.4 + 461127123037923526023110441369037636541248201530*R.4^2 + 706233715807653977148677996681463942910375573020*R.1*R.5 + 543376204141349492720056064861686692260133375954*R.2*R.5 + 330178484169754299119615908622400514994411867933*R.3*R.5 + 831180871533064830665472739768596529657163783612*R.4*R.5 + 55134664996107069596519135457161147922532056459*R.5^2 + 758540503555547312561655506589674646672497746418*R.1*R.6 + 8506367484994840426198495634430036862327625505*R.2*R.6 + 919228861466472589966369744061202118160501966171*R.3*R.6 + R.1*R.8,
    737754799844992092101694039374353420834419203557*R.1^2 + 835437385671711015922792428717328353247825197555*R.1*R.2 + 1263763118826627658227941640551659304158815660082*R.2^2 + 380961065057340438961658114569256568330245316470*R.1*R.3 + 247899295616903052473126887233894101940859180732*R.2*R.3 + 1098885830840004481740048225748218119617975447480*R.3^2 + 84529933400368338604904250544468074777901621728*R.1*R.4 + 333594029862674814081976275068229664448891349798*R.2*R.4 + 1292840129463559812699770690846823141973015590797*R.3*R.4 + 408545377476469786356030735928299774789826635176*R.4^2 + 13104692229072246134451431573866010541898771187*R.1*R.5 + 523840773053392464256877818616245960378610657115*R.2*R.5 + 327767501437553475702500003629388093630702519729*R.3*R.5 + 21670047068410482925221206458383238373056215167*R.4*R.5 + 473771041805617261268604178529698174942123329985*R.5^2 + 303562672245007189948307616937477787538679681452*R.1*R.6 + 47674914755651712653055616639137438449488058552*R.2*R.6 + 599632248405045557482391330960611962411773193177*R.3*R.6 + R.6*R.9,
    851883757081510280353386622104768597649662644262*R.1^2 + 1084321835756900589782820815102070302809999071200*R.1*R.2 + 391612902825248250906681947567010509291558329922*R.2^2 + 121777409596208066792054932723172135151604441467*R.1*R.3 + 1278589675684176608437680013763803031231378039686*R.2*R.3 + 389075682100566946867185883560319288936475698258*R.3^2 + 1328099954635306855395000151322118252465984904781*R.1*R.4 + 71080222084056441562386340651317063228587433325*R.2*R.4 + 963422476251227464381870618342846783937024666123*R.3*R.4 + 759822853660409966397555528235624352235891910188*R.4^2 + 704403716830791349081437162267316890633734006787*R.1*R.5 + 199100653780117002642024204665874783753117092071*R.2*R.5 + 118019753577397746552548181452651086252694482177*R.3*R.5 + 1271870844820234846212706617377468136263049726493*R.4*R.5 + 80194971769322549705726919106606708252447051168*R.5^2 + 79123713179996225595284037105138870514737168301*R.1*R.6 + 553432292673181711112814948619899641019630545601*R.2*R.6 + 863230600513644686635702366248514228585816617514*R.3*R.6 + R.1*R.7,
    864152775814824212923787682659783645473234047410*R.1^2 + 678396439927152490944804948904854702059989390019*R.1*R.2 + 926966564716367197291599431347265816603493511756*R.2^2 + 486214099904941508878924540059811971515732174508*R.1*R.3 + 866625062607787245972510236856701734797642329168*R.2*R.3 + 1058217028597271934897888369387642694030332443910*R.3^2 + 410390152615778646388722954594121861443278831476*R.1*R.4 + 1055683764410972227529057993774140997307744814266*R.2*R.4 + 1169590044288122637511148778922218162242344214858*R.3*R.4 + 509508703226379225002108210990989173117022038040*R.4^2 + 505554448009511770660786983399793260572199318183*R.1*R.5 + 947519553934979442793224647115644930165270838783*R.2*R.5 + 982652334860778054239632887112024352734444054337*R.3*R.5 + 1104242076169099964034993503552198382311111910445*R.4*R.5 + 1311182617924043580574583549414787120105885910531*R.5^2 + 499211391667703727522688610427569640442870284477*R.1*R.6 + 485000114597318664057477294717064635870972687272*R.2*R.6 + 272610327890028866000261155842873506801083900526*R.3*R.6 + R.3*R.10,
    936219340740941496896672199223218200461227813832*R.1^2 + 858974135404107443837197779507942767815310178414*R.1*R.2 + 860054968388067385828896264773319001600095995046*R.2^2 + 927229185948964238984572390053289048783497754816*R.1*R.3 + 613374934862998646047612961996567679894571106741*R.2*R.3 + 648033642033345794202209700810813837641406559893*R.3^2 + 1328766435891624167680355878627461588730117641079*R.1*R.4 + 1306696792503413759205110285460356559432184019132*R.2*R.4 + 606287030929923053427074201286203721398852179526*R.3*R.4 + 873417082576083365382752846310929335888861153965*R.4^2 + 364412184704548016982613026529224494380313407072*R.1*R.5 + 471022048928420324123475266068953450583337468317*R.2*R.5 + 1101604437825895845017127849811815702246261631739*R.3*R.5 + 1133765153037980441227538847123422772239588691709*R.4*R.5 + 651889431008723242303513123503137304200646599885*R.5^2 + 111778958947351695573008731073447379980263731655*R.1*R.6 + 20546566281411899872527386874807654258497150044*R.2*R.6 + 1212154045597039584960999211691624960639807324146*R.3*R.6 + R.4*R.9,
    989298567661039966948660407733159588923190965174*R.1^2 + 136507888299828014740969213390942142088939601127*R.1*R.2 + 151360157025259274390999926526647335763235683437*R.2^2 + 80152881639491820213515097875816840303915629830*R.1*R.3 + 909840714018178347961537323164765356029251015093*R.2*R.3 + 547239505106971934070451258750623036765016830016*R.3^2 + 859443244897770739848917930622470848814347966393*R.1*R.4 + 1130124047513970295483218243895062943328434245292*R.2*R.4 + 398841728197187773628421717066360528160406395556*R.3*R.4 + 534199356986825841456683016589297544266875934627*R.4^2 + 452252273757467566168914032772696024819093395451*R.1*R.5 + 1018286541106681747998358218426091416163953042562*R.2*R.5 + 498277945766887496199418842494308169053992611501*R.3*R.5 + 720015197643713225903077019237623376048201052071*R.4*R.5 + 744974022060136550582078499098830807668501625426*R.5^2 + 617015560954341846124073521755187419125718994334*R.1*R.6 + 490256647706420048027953286121497460137047235530*R.2*R.6 + 111844231918353183247975818130654467571440317562*R.3*R.6 + R.5*R.10,
    1011623624865729245088367981090932893090201845362*R.1^2 + 744388341256068793631856918604345174862535437092*R.1*R.2 + 212913565695628869029276184192644335027635714276*R.2^2 + 1193023480900726207584053810110345697133597400925*R.1*R.3 + 1105709686516050381807531589834536494103196834351*R.2*R.3 + 703802436677906014989259528646264116617047977942*R.3^2 + 170376802073865298865714516269307341821404267891*R.1*R.4 + 1027998288603767937465778880263520129286244684885*R.2*R.4 + 708316952233466865286815421961716468802001784719*R.3*R.4 + 615907693415614990597043125880350268740241581086*R.4^2 + 662639795429754345728930615822904869338709983607*R.1*R.5 + 772308579081458994754111446199889045484087148275*R.2*R.5 + 638717267982928518987265758952165297805940723141*R.3*R.5 + 468394561143298717306671887347053803034457825385*R.4*R.5 + 1031507028631795914095906700123824903094615439269*R.5^2 + 1088061530811820940093770836173538124367537911019*R.1*R.6 + 1170974644961421688486515350273150643482069017880*R.2*R.6 + 417244433011087118227855129801920402337224639405*R.3*R.6 + R.7^2,
    1017876705632858391231803339392035780756209274678*R.1^2 + 217080161054037355350847308133694867069909830545*R.1*R.2 + 684463285895391002710988882939992854674650544112*R.2^2 + 1301086335691274017341735402276413401548003637260*R.1*R.3 + 720523199104098278259424583400948950987292387672*R.2*R.3 + 485198580201436458063870745842849196446630275510*R.3^2 + 311815584662106764780157457414574833646013396747*R.1*R.4 + 160487121820917687685404285524112881770931418932*R.2*R.4 + 908257363943408851455740713657489027213169740952*R.3*R.4 + 529784356580370372727842283626207466163959157663*R.4^2 + 476850925698860348079316282066933971957705366149*R.1*R.5 + 562907069264378981637377347932943306142494440513*R.2*R.5 + 590964027126260748355174786758768941290238177195*R.3*R.5 + 1266007877112580599297730780797695001206606295843*R.4*R.5 + 904704239072345707385431258823080338697156908056*R.5^2 + 229455352875206896552176592675939713607507030403*R.1*R.6 + 750494829567203905550649085938435912271419948985*R.2*R.6 + 993405729298850293243734662318285276481141114283*R.3*R.6 + R.3*R.7,
    1040936980130694585523379549408693552372335106593*R.1^2 + 370040603093629665159256751996278546548451662473*R.1*R.2 + 1035022783041521676744622369342334953737097440050*R.2^2 + 344077542114652922948792860228362795386889753903*R.1*R.3 + 417223303790781184462413487793509865312937852693*R.2*R.3 + 1240924375229117466652588098080152144072844522710*R.3^2 + 450370451289366631739928696461999067226677605285*R.1*R.4 + 596927220705769782649040163550195505737276064151*R.2*R.4 + 583954083527685431497291552998221409540877183099*R.3*R.4 + 810283665410672986237916577709246848117944397785*R.4^2 + 158113073559246638718313131924955594303112909191*R.1*R.5 + 462953684119343840105511180620869567386015357808*R.2*R.5 + 19799363080013006149517148291528526520795251039*R.3*R.5 + 1318184524868693505799654127269147427310507800292*R.4*R.5 + 834999954943910677575090427942301479267439634049*R.5^2 + 1298016600905534116156395396692487136946990676346*R.1*R.6 + 785858207804328389087266356939365894061793490550*R.2*R.6 + 163246130006936844552752327684062275602725989589*R.3*R.6 + R.4*R.10,
    1129790016909648760451731371160471809458396867745*R.1^2 + 833928905448811314734305990430441595627022416856*R.1*R.2 + 641866823182638980802166834350507630211306888506*R.2^2 + 260672909689718527346898660961558044489005646053*R.1*R.3 + 400452952290889330476270157529442954040786046235*R.2*R.3 + 1200728532829022147854147774947078807284810524273*R.3^2 + 882492042180005267981360605531385466330981681789*R.1*R.4 + 288936200133557514264590165203861417812083615993*R.2*R.4 + 813722203047813268564303938170314121216398972908*R.3*R.4 + 1285764080319126398972130103771092561547673324076*R.4^2 + 1068875172859286562020742395659937193755691020785*R.1*R.5 + 1258866088623402612951096490843399087741962695719*R.2*R.5 + 493297458572962912066514577175059184292891077180*R.3*R.5 + 1000854080079905761535556530168805391412003513830*R.4*R.5 + 741341298703273024222569075026625159306086943994*R.5^2 + 491818737267939185418177113138924029488694477452*R.1*R.6 + 110685099256540879651352273772805313256737218416*R.2*R.6 + 829012892525592496376873345745330968256117990049*R.3*R.6 + R.1*R.9,
    1182628212252664412707715251565961000490693794986*R.1^2 + 961795704065636804407873799267696124229887406155*R.1*R.2 + 1199389290700369102111437159094532692330695964192*R.2^2 + 241627731154998475085743629972192131621208736368*R.1*R.3 + 127651506433459085110064906666724786726689698392*R.2*R.3 + 153762393285554285364681526304706292912086777815*R.3^2 + 304521483146942498310914500363261751204471081507*R.1*R.4 + 722059176340770517935365667402768079369363569116*R.2*R.4 + 484712030536727646927410027356547650097994266006*R.3*R.4 + 1219613588983352439576815473967771019809278666491*R.4^2 + 294446558660107455347768422633044113428079968810*R.1*R.5 + 882076424906049318716407598511116271780934775030*R.2*R.5 + 83026246840707162221212675014929251841328526679*R.3*R.5 + 371990455785443616804450697489523353383348223051*R.4*R.5 + 110681030233786227472680846666653608773711117018*R.5^2 + 1063011678275186648400864425869509708221203621035*R.1*R.6 + 1309755306949443315677707991730631858428419425562*R.2*R.6 + 434217281013097074524997037346405234933574062068*R.3*R.6 + R.5*R.7,
    1241814495637128301876139345031314564070237708720*R.1^2 + 72497528758789801831815284548014441675068204661*R.1*R.2 + 836857779723882763983511171913599331089545976641*R.2^2 + 1247097840657400013089987576063911479029301277062*R.1*R.3 + 122267427314391436505273485415871744398095673047*R.2*R.3 + 1208258962780566190416894783053254064269231687043*R.3^2 + 129175353240084163155249055234725973363431851813*R.1*R.4 + 318358053013658217451618759172213270111511752839*R.2*R.4 + 1326906264481517356881886906450066212414008680171*R.3*R.4 + 1039025203342653023865509301792329672400378570467*R.4^2 + 1089169195145555979029706735297996643947157335966*R.1*R.5 + 660028930397752582016814274796736354629842825231*R.2*R.5 + 23624767382470621460315574468511718501211863761*R.3*R.5 + 996722393162264600933859190698329197150817273003*R.4*R.5 + 904714103373495157709420192678711855483530808039*R.5^2 + 458413467896237147748609949381431459376975231500*R.1*R.6 + 710421531105281659927397875767100465471672455798*R.2*R.6 + 1132703904215000730945451692687216430304324122001*R.3*R.6 + R.1*R.10,
    1279128885069567071244451571864488978029759512307*R.1^2 + 1114171393919485964768020682608051879315620076455*R.1*R.2 + 705609957424106378710384751968391710225837105835*R.2^2 + 746714706387981147657898117566425668062019551289*R.1*R.3 + 708983856429916993745745880608342106307158741328*R.2*R.3 + 96694896189247659675419217295672274971935023998*R.3^2 + 937534149323380754352758913534703112825783080800*R.1*R.4 + 1131157492666909919245424432948819302792235764969*R.2*R.4 + 529325250185557786148435548287748710929309745992*R.3*R.4 + 395084137411848022973015139421217671515169770405*R.4^2 + 146302259763334092830412581515361475243662836870*R.1*R.5 + 387520640703438463360914366168887134934909312618*R.2*R.5 + 240916923663540862809460983087860480157943337620*R.3*R.5 + 8129557414497891816917142900355088377758565897*R.4*R.5 + 161312094972868703848797948451483133598107320839*R.5^2 + 896039289826144993595571979053052509491781836661*R.1*R.6 + 379293251257048952867680099572277826020852028449*R.2*R.6 + 773956115641548272678743624746572430001537499767*R.3*R.6 + R.6*R.8,
    1279421006815536940412299263108391905117310050676*R.1^2 + 873286738604156089213828487946043524115707764450*R.1*R.2 + 1308857323285108159672176799761211501612920011221*R.2^2 + 223928256516393893615169529862003177481277753573*R.1*R.3 + 782912582767379041941338180502714743951663842167*R.2*R.3 + 1018239528118679672380087335585609972123957728036*R.3^2 + 1318914211377861126937260843074370310156652575231*R.1*R.4 + 1115398129346637612503092018605094376294948569278*R.2*R.4 + 325020427495746295709280286808291455931040291188*R.3*R.4 + 233734589316412638908998925651175121456308047009*R.4^2 + 1189840045480413427671858865577810843609534033095*R.1*R.5 + 1167785660126355020484917365010774868662346788982*R.2*R.5 + 173761849596649441935289250132889817530923496207*R.3*R.5 + 1181176411417527506940372780979226085564574407982*R.4*R.5 + 1275525163824421152703766900488786813696847672916*R.5^2 + 364395096078654119159598171556562582079653413873*R.1*R.6 + 1080778083778637922699999688596355111881993962970*R.2*R.6 + 1312871953369969735307299426195045117877584714688*R.3*R.6 + R.7*R.9,
    1284636425570325056557374958670174032021715145902*R.1^2 + 39362333034327921873738773378184978517208161132*R.1*R.2 + 1054502420395847263270112525498986788430181344631*R.2^2 + 1186395517659897323875038746655022110975202439623*R.1*R.3 + 98062530340056669804558436873826818527458054177*R.2*R.3 + 257985082385858283929204314252153951088169195883*R.3^2 + 871121798253254996216201791396205068927136733134*R.1*R.4 + 923020618904098345093504392938067317429723817265*R.2*R.4 + 167845337684610340897117893359484571187229664194*R.3*R.4 + 1063139788752969549344624089192074410849974447901*R.4^2 + 399696345891361273072134320382607885339415807614*R.1*R.5 + 176190868332918370459037537910121829504994248242*R.2*R.5 + 980241549439727108746500928438982924084262948249*R.3*R.5 + 192238929186267674872894390187371421546158300798*R.4*R.5 + 712545427993575363311225566426737791275021546770*R.5^2 + 714782241915115686473797531912679065372185994858*R.1*R.6 + 639303914956319547071231374359871713111589394256*R.2*R.6 + 206480753915927763188882952159927508328008652163*R.3*R.6 + R.2*R.7,
    1301677482480024084218154573246987013377310797088*R.1^2 + 63891973179102220655255807855224043541890792897*R.1*R.2 + 906366623805403934277823028071494730807335780434*R.2^2 + 507758919284308183760150488864100315043514761927*R.1*R.3 + 580258497940604335814555085820006451061445114449*R.2*R.3 + 950798423941605169125059400004876562400320027433*R.3^2 + 242898561560384995635380816957155990418988512992*R.1*R.4 + 766612868379062960824489354835063412777364310031*R.2*R.4 + 1204117940760413513909913621857623250437054967908*R.3*R.4 + 120042161744563912644169483805399489924848470085*R.4^2 + 206662052808740071817155563095945221727015020695*R.1*R.5 + 401560334870752951308834345139116562138553871125*R.2*R.5 + 1328534666607097663386191821728465284816324430178*R.3*R.5 + 1338512747478521259989528358967328903839767117591*R.4*R.5 + 88305292063010617050643191326460044415037056103*R.5^2 + 367918988419140854339548251130600765890123009769*R.1*R.6 + 746487536467227891790155683443466795366251078901*R.2*R.6 + 845089650128863910787914063263657111842551052205*R.3*R.6 + R.5*R.8,
    1326738583334948174314719014561212149547837644125*R.1^2 + 698865321663125991787166892330833101000528522220*R.1*R.2 + 506405345529218808133753418814268953397781593039*R.2^2 + 130308256928103078399726181246488964410241919543*R.1*R.3 + 445471964496211148254958835201711336976086184327*R.2*R.3 + 1127066926049450363730209866803128335868883843958*R.3^2 + 1328569301690682735455930049477210306779249560574*R.1*R.4 + 815181453072936983303267880553963649301514719219*R.2*R.4 + 607658590966701403670373755552030555278883324050*R.3*R.4 + 195400081781559002352398397058019499828695581324*R.4^2 + 551923402083237912283116794354668418076499435396*R.1*R.5 + 981054651719021713007999077476798403652203735278*R.2*R.5 + 952517889799187472803874451963017553277834425467*R.3*R.5 + 1089992519992980809091980456030364584955533396370*R.4*R.5 + 517294025733718377653959663977948364244825471724*R.5^2 + 591596826257912801774750126805682124699425066100*R.1*R.6 + 325416513416754516743640832821892484105228125813*R.2*R.6 + 1158753961788828423055473471452459777636561056056*R.3*R.6 + R.2*R.10,
    1333703079722953161412787183841251191113887892742*R.1^2 + 1097950958166869923680801491199903692396909902892*R.1*R.2 + 1263834447810536670340984461376622876320186625436*R.2^2 + 23049055994997817439801994405242919278338466114*R.1*R.3 + 533691927677355577678452573806210012083154900033*R.2*R.3 + 1027138297225622193546194175281383133149896166712*R.3^2 + 1302683564559877067686511561083634657541442566336*R.1*R.4 + 1188820052931541940949092923800834599099408384769*R.2*R.4 + 20860754199026842775038833689267314283752936263*R.3*R.4 + 237718771345205498441109954683739433973728903887*R.4^2 + 946047696039873760036923814935773227823977598433*R.1*R.5 + 444644558950619528600127062416074596494918425394*R.2*R.5 + 41504839088889967766528968442648363899560038630*R.3*R.5 + 1241052975313605751003436620567826667191250340112*R.4*R.5 + 929152102180897394659342634682155176104640063140*R.5^2 + 418372148855804731890603763420684709839849100309*R.1*R.6 + 1203030347840406708109881475005980864470227664887*R.2*R.6 + 148007044970500408514817744738164899589677841012*R.3*R.6 + R.9^2,
    1345180022191221018722440855018653650342051285410*R.1^2 + 1236948240225979908878331598795283337178184164489*R.1*R.2 + 348127508384063174771835008669676119994415908267*R.2^2 + 1129327621086205465178170140756985306803085175982*R.1*R.3 + 275645560359611180608207995465330483959875167184*R.2*R.3 + 1286450833606923158327147721120828708997909179469*R.3^2 + 159021275309498697905358443953120000912620922501*R.1*R.4 + 343169657396046083326605769029421919833709177665*R.2*R.4 + 629883097212203126837801805786555789611206834510*R.3*R.4 + 455302030804570538959104747377078490773550219256*R.4^2 + 202639421490418083369163915027453970592096725769*R.1*R.5 + 629823449222411155760717287712801964644457481594*R.2*R.5 + 1228446478971927973755975603757511825377021036289*R.3*R.5 + 794547791290080703219718880699029251230794271251*R.4*R.5 + 704444136775309757830293843592877705007425973386*R.5^2 + 388447851227689437703060895577531758797630280001*R.1*R.6 + 1220631362163879206873404367533399058135670847458*R.2*R.6 + 902724868203224808913078499450546610403556420433*R.3*R.6 + R.5*R.9,
0]>;
C := Curve(P, I);
P := C ! [1219918568464506277694891073526854085030885236055, 998069048488306748601953541245307569402383643567, 1077216159748039451592616675478146663167997385588, 199310232432685240921684212101359575016951372728, 708429357123608526078606140687661895732330351820, 278143183113589634917365419123914960458635520422, 993274288945222355775143927532988307071875802558, 1333127232753634974048775376301720835742003515668, 36862811340932810675092362517771945022735733738, 871151918055750356700787754056760699978818431769];
E,iso := EllipticCurve(C, P);
E;
iso;

In absence of an expensive Magma license, we may now evaluate the above code using the online Magma calculator. This takes about 10 seconds and comes back with the following result, which we save in a text file called magma-out.txt as preparation for the next steps:

Elliptic Curve defined by y^2 + 13255448090727804863157206330839645068903994869\
32*x*y + 437943773325716325520870009535420589146317329696*y = x^3 +
443628925042378618870389769217281672166497475622*x^2 +
1083571847171430948632703579078677898360215000209*x +
212944570536360804100612107432880508598026276989 over
GF(1349317116055496347935183323829721306283718936287)
Mapping from: Crv: C to CrvEll: E
with equations :
825445843231864944581710837451953877551130202770*$.8^2*$.9 +
    692739392563514074916963216834047486315329478936*$.2*$.9^2 +
    781039368144813328229838624031430810705275953777*$.3*$.9^2 +
    605821189201418442494311002426162965429700681347*$.4*$.9^2 +
    662506821676780499481557120599331876296876837369*$.5*$.9^2 +
    301614859855568205074390967136901748071597853141*$.6*$.9^2 +
    162380679450177085207450460237524361237655663488*$.7*$.9^2 +
    960099554030879214507436421581360631028696638014*$.8*$.9^2 +
    85068600771438703993162557230984062102405319784*$.9^3 +
    1165347891547226379252669672596558365163915260566*$.8^2*$.10 +
    1104246119657152097995211393954500663345219334094*$.2*$.9*$.10 +
    673063040060262761664287298098209372905413005505*$.3*$.9*$.10 +
    149184575268541968017363335770019144097723589449*$.4*$.9*$.10 +
    1006276392589316494891932978361933622018152679742*$.5*$.9*$.10 +
    986373094400306451075526357646644175620882953358*$.6*$.9*$.10 +
    23472101663027371900558879770996080371568373529*$.7*$.9*$.10 +
    107023971731993423520691999790215006213639866294*$.8*$.9*$.10 +
    1222837391369337019132647572590086554673445177506*$.9^2*$.10 +
    374525091513822270482150420805961471094760210035*$.2*$.10^2 +
    136254334383887350007902994549914021397313378549*$.3*$.10^2 +
    1090529094220156212938413888571914627736002945368*$.4*$.10^2 +
    488049074038454083270100335255263481490869208098*$.5*$.10^2 +
    807535702158263706617628808583744372853247889113*$.6*$.10^2 +
    533018603581107184225366243661758273976395792667*$.7*$.10^2 +
    324449414240480424725305827132872559160265238544*$.8*$.10^2 +
    471176213026882747092902524099080402349373994996*$.9*$.10^2 +
    709471249680569541725875808804559853562299022061*$.10^3
1075392122030537353827805033324981359720104383778*$.8^2*$.9 +
    1295809633569250533760062103123527972894817687426*$.2*$.9^2 +
    647703324540922289540053179028225904932117235980*$.3*$.9^2 +
    529558088983117646953219422531999959215408713938*$.4*$.9^2 +
    656214240536465409597140264252114988773568598563*$.5*$.9^2 +
    150194779418441823781521978103558085929643714707*$.6*$.9^2 +
    502851687725510046519055262205225485339508267784*$.7*$.9^2 +
    547115751094418040182614644454893158190801352218*$.8*$.9^2 +
    737744613831954397656601412470639627481515387958*$.9^3 +
    664839263457822401321038543937660785599120053036*$.8^2*$.10 +
    521093248607400860579556706777371692340021106699*$.2*$.9*$.10 +
    386676704871431959195706807476976554011649019265*$.3*$.9*$.10 +
    928685255693725912319641499567584999775065854707*$.4*$.9*$.10 +
    1032449755424810054918705112989412275089135113262*$.5*$.9*$.10 +
    30013165478193315615085062995166082015867132478*$.6*$.9*$.10 +
    54798624215317106587255993072065409592553777984*$.7*$.9*$.10 +
    1090369409738070408402469731469477134434938384190*$.8*$.9*$.10 +
    295848180080426923837862446979623514707658466287*$.9^2*$.10 +
    5738134897212554192088644475337396686553812071*$.2*$.10^2 +
    771746922349272145388445435512581201370478191837*$.3*$.10^2 +
    463715092519043243255439645784982507686738942222*$.4*$.10^2 +
    572604907099955327687144991933820563827134547583*$.5*$.10^2 +
    381990640071009546066135052506510156358351450501*$.6*$.10^2 +
    728380524020933578289485791543400460654720459450*$.7*$.10^2 +
    769684157472201654846127051860300911337560723512*$.8*$.10^2 +
    662623765011992014352535840149562838257064201541*$.9*$.10^2 +
    1180230859399133640179144857138988960337129024756*$.10^3
$.9^3 + 309374624238982438721810169617756686893129491711*$.9^2*$.10 +
    832322217208118592766048364464543273998591100318*$.9*$.10^2 +
    473692151696456587592266923249061335962601751444*$.10^3

At this point all we have to do is importing the elliptic curve and isomorphism from above back into Sage, and then proceed to solve the DLP in Sage as per usual CTF standard procedures.

Solving the DLP on the elliptic curve

Now that we finally have our hands on the elliptic curve under consideration in a more convenient representation, let's see what's going on:

sage: p = 1349317116055496347935183323829721306283718936287
sage: E = EllipticCurve(GF(p), [1325544809072780486315720633083964506890399486932,
                                443628925042378618870389769217281672166497475622,
                                437943773325716325520870009535420589146317329696,
                                1083571847171430948632703579078677898360215000209,
                                212944570536360804100612107432880508598026276989])
sage: E.order().factor()
31306060063 * 6565122100096804799^2
sage: E.abelian_group()
Additive abelian group isomorphic to Z/205528106786559269151880642337 + Z/6565122100096804799
  embedded in Abelian group of points
  on Elliptic Curve defined by y^2 + 1325544809072780486315720633083964506890399486932*x*y
                                   + 437943773325716325520870009535420589146317329696*y
                             = x^3 + 443628925042378618870389769217281672166497475622*x^2
                                   + 1083571847171430948632703579078677898360215000209*x
                                   + 212944570536360804100612107432880508598026276989
  over Finite Field of size 1349317116055496347935183323829721306283718936287

The sizes suggest to solve the modulo‑$31306060063$ part directly on the elliptic curve and use the pairing-friendliness of the curve for the subgroup of order $6565122100096804799$ to project that DLP to the base field, which can conveniently be solved within a few seconds using the CADO‑NFS tool.

(Perhaps one could also solve everything directly on the curve, but in my tests that seemed significantly more annoying than using the pairing.)

Thus, we end up with the following fully automated solve script:

#!/usr/bin/env sage
proof.all(False)

from formulas import p, zero, base, add

################################################################

import socket
sock = socket.socket()
sock.settimeout(10)
sock.connect((sys.argv[1], int(sys.argv[2])))

class ufail(Exception): pass
def get():
    r = b''
    while b'\n' not in r:
        try: tmp = sock.recv(1)
        except socket.error as e: tmp = b''
        if not tmp: raise ufail(r)
        r += tmp
    return r.decode().strip()

import ast
pub = ast.literal_eval(get().removeprefix('pub = '))
print(pub)

################################################################

F = GF(p)

projdim = len(zero) - 1
Us = PolynomialRing(GF(p), 'U', projdim+1).gens()

pts = [zero]
for i in range(10):
    pts.append(add(pts[-1], base))

magmaout = open('magma-out.txt').read()  # from solve.sage
magmaout = magmaout.replace('\\\n', '')
magmaout = magmaout.replace('\n    ', ' ')
for i in reversed(range(projdim+1)):
    magmaout = magmaout.replace(f'$.{i+1}', f'U{i}')
maps = magmaout[magmaout.index('with equations :'):].strip().split('\n')[-3:]
maps = Sequence(maps, Us[0].parent())

################################################################

down = lambda pt: P2([f(*pt) for f in maps])
P2.<X,Y,Z> = ProjectiveSpace(F, 2)
Epts = [down(pt) for pt in pts]
mat = []
for Ept in Epts:
    x,y,z = Ept
    if z != 1:
        continue
    mat.append((y^2-x^3,x*y,-x^2,y,-x,-1))
mat = matrix(F, mat)
ainvs, = mat.right_kernel_matrix()
ainvs /= ainvs[0]
E = EllipticCurve(list(ainvs[1:]))
print(f'{E = }')
print('order:', E.order().factor())

Ezero = E(down(zero))
Ebase = E(down(base))
Epub = E(down(pub))

n = Ebase.order()
l = gcd(n, p-1)
assert n.gcd(l^2) == l
assert all(l.divides(inv) for inv in E.abelian_group().invariants())

sec0 = (l*Epub).log(l*Ebase)
from vuln import scalarmul
assert sec0*l*Ebase == l*Epub

print('\x1b[33m', file=sys.stderr, flush=True)
print(f'{sec0 = }', flush=True)
print('\x1b[0m', file=sys.stderr, end='', flush=True)
print()

Gl = n//l * Ebase
assert Gl and not l*Gl
Gl.set_order(multiple=l)
Hl = n//l * Epub
Hl.set_order(multiple=l)
while True:
    Tl = E.random_point()
    Tl *= E.order().prime_to_m_part(l)
    assert not l*Tl
    if Gl.weil_pairing(Tl, l).multiplicative_order() == l:
        break
gg = Tl.weil_pairing(Gl, l)
hh = Tl.weil_pairing(Hl, l)

def compute_log_cado(elt):
    import subprocess
    l = elt.multiplicative_order()
    cmdline = f'''
        cado-nfs.py -t 4 -dlp -ell {l} target={elt} {p}
    '''.strip()
    try:
        res = subprocess.check_output(cmdline, shell=True)
    except subprocess.CalledProcessError:
        print(f'\x1b[34m{cmdline}\x1b[0m')
        print('\x1b[36m', end='', file=sys.stderr, flush=True)
        res = input()
        print('\x1b[0m', end='', file=sys.stderr, flush=True)
    sol = ZZ(res)
    return sol

logg = compute_log_cado(gg)
logh = compute_log_cado(hh)
sec1 = logh / logg % l

print('\x1b[33m', file=sys.stderr, end='', flush=True)
print(f'{sec1 = }', flush=True)
print('\x1b[0m', file=sys.stderr, end='', flush=True)

sec = ZZ(CRT(sec0, sec1, n//l, l))

print('\x1b[33m', file=sys.stderr, flush=True)
print(f'{sec = }', flush=True)
print('\x1b[0m', file=sys.stderr, end='', flush=True)

sock.sendall(str(sec).encode() + b'\n')

flag = get()
print()
print(f'--> \x1b[32m{flag}\x1b[0m')
print()

Flag!

Running the solve script above against the server takes less than a minute and finally yields the flag:

$ ./pwn.sage 195.201.94.102 17017
(1, 1229765871947158570049773687255148929444787659253,
 925772228032018796531888914750464872341896804384, 266246974870629971067440040317696276014498367157,
 1187923295360188847687454676236366451395837918274, 1162840830008539476912207245971524055428875712520,
 1255744061468700405916315497362820049073936210294, 168935771674364294518903796705554140669214439778,
 1311406717082717531354584201591366522922075798037, 1273418494212678784901922446965594449743958279887)
E = Elliptic Curve defined by y^2 + 1325544809072780486315720633083964506890399486932*x*y
                                  + 437943773325716325520870009535420589146317329696*y
                            = x^3 + 443628925042378618870389769217281672166497475622*x^2
                                  + 1083571847171430948632703579078677898360215000209*x
                                  + 212944570536360804100612107432880508598026276989
    over Finite Field of size 1349317116055496347935183323829721306283718936287
order: 31306060063 * 6565122100096804799^2

sec0 = 2066147624

[...lots of CADO-NFS output...]

sec1 = 5695101166226907093

sec = 179149967451629912121832980432

--> hxp{Wh4t_1s_c0mmUt4T1v3_4Nd_h1gH_d1M3Ns10n4L?}

(If you're interested in how the formulas were generated in the first place, come talk to me! :^))