from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
from hashlib import sha256
from Crypto.Util.number import getPrime, GCD, long_to_bytes, inverse
from random import randint

FLAG = b"HackCTF{????????????????????????????}"

p = getPrime(512)
q = getPrime(512)
n = p * q

r = randint(1, n)
v = (p * r) % n

kA = randint(1, n)
while GCD(kA, n) != 1:
    kA = randint(1, n)

vka = (v * kA) % n

kB = randint(1, n)
while GCD(kB, n) != 1:
    kB = randint(1, n)

vkakb = (vka * kB) % n

vkb = (vkakb * inverse(kA, n)) % n

v_shared = (vkb * inverse(kB, n)) % n

key = sha256(long_to_bytes(v)).digest()
cipher = AES.new(key, AES.MODE_ECB)
c = cipher.encrypt(pad(FLAG, 16)).hex()

print(f"p, q = ({p}, {q})")
print(f"vka = {vka}")
print(f"vkakb = {vkakb}")
print(f"vkb = {vkb}")
print(f"c = '{c}'")