tldr;- server has a fixed private key which is used to encrypt the flag- server accepts two different curves (secp224r1 and secp256r1) but uses only secp224r1 for its public key- server checks that the client's public key point is on the curve it specifies- server reduces client's public key coordinates modulo p224 before performing scalar multiplication with its private key to get the shared secret- this allows for an invalid curve attack by choosing points on secp256r1 such that, when reduce modulo p224, have small order on the new curve that they lie on- gather information about the private key in this way for many prime orders, then combine with CRT to recover the private key
[writeup](https://jsur.in/posts/2021-07-19-google-ctf-2021-crypto-writeups#tiramisu)