celestial order

Author: 0xIDA
Platform: FlagYard · Category: crypto · Difficulty: Medium

Solvers

solve.py

Summary

Modified Ed25519: SHA-512 replaced by four concatenated MD5 digests, and nonce hash is H(m || sk_suffix) (message prefix). An MD5 collision pair gives identical nonces (same R) for two messages; two signatures recover scalar a, then forge a signature for gimme the flag.

Solution

# 1) Known equal-length MD5 collision m1,m2
# 2) sign both → same R, S1/S2
# 3) a = (S1-S2) * inv(H(R||pk||m1)-H(R||pk||m2)) mod L
# 4) r = S1 - H(R||pk||m1)*a
# 5) S = r + H(R||pk||MESSAGE)*a ; submit (R||S)

Flag

FlagY{d80917ef064243a6fc75c20f55cb0452}

Live submitted: success (2026-07-12).