What the HECC 2 - TRC CTF 2026 - Writeup

This challenge involves hyperelliptic curves and understanding the Cantor’s algorithm to be able to construct a relationship that can be used to extract some small roots using the Coppermisth algorithm. We are given a chall.sage file that, first of all, sets up some parameters: p = 94235683804629271565982999971710609375595046800623466974818400769289845080223265348096429515360903332205728922039831445325696288131469248632324474133225349921788521516761748848030075106682083159721250623229343087538822420218805346047462578541418450143242476874246298541119785973740522737514515994196626057947 Zp = Zmod(p) R.<x> = PolynomialRing(Zp) a = 50388745719041913460291516577153707251851589986907343887836950814620908576049743625336406788413868434770966202375151155498184781903665587711680037916397047153196612649839072989391148224527332860455558388897073964777769901562543742670098611486382534056016050623712004728700806297510524525947953184925678738191 b = 77079665980869941586534539811707525781544605363177140690146778399875761035230354698555185675543136711786384579448967682817286610411073515757944721339483414323574243444638341503092366359064263273232684465918634617514909696812221857920483650952488398729514231494850081371324567953025480739514958298506881528450 F = x**5 + a*x**3 + b*x H = 0 C = HyperellipticCurve(F, H) J = C.jacobian()(Zp) In the general case, a hyperelliptic curve is defined as: