[Given Data]
<super-metroid.sage>```from Crypto.Util.number import bytes_to_long, getPrimefrom secrets import FLAG
def gen_key():	from secrets import a,b	E1 = EllipticCurve(F, [a,b])	assert E.is_isomorphic(E1)	key = - F(1728) * F(4*a)^3 / F(E1.discriminant())	return key
def encrypt(message, key):	m = bytes_to_long(message)	e = 0x10001	G = E.lift_x(Integer(m))	P = e*G	return int(P[0])^^int(key)
p = getPrime(256)F = GF(p)E = EllipticCurve(F, [1,2])key = gen_key()
c1 = encrypt(FLAG[:22], 0)c2 = encrypt(FLAG[22:], key)
print(f'p = {p}')print(f'c1 = {c1}')print(f'c2 = {c2}')```
<output.txt>```p = 103286641759600285797850797617629977324547405479993669860676630672349238970323c1 = 39515350190224022595423324336682561295008443386321945222926612155252852069385c2 = 102036897442608703406754776248651511553323754723619976410650252804157884591552```
[Solution]
The* key *is j-invariant of E1.It is equals to  j-invariant of E because E and E1 are isomorphic.
<solve.sage>```from Crypto.Util.number import inverse, long_to_bytes
p = 103286641759600285797850797617629977324547405479993669860676630672349238970323c1 = 39515350190224022595423324336682561295008443386321945222926612155252852069385c2 = 102036897442608703406754776248651511553323754723619976410650252804157884591552
def decrypt(ct, key):	c = int(ct)^^int(key)	P = E.lift_x(Integer(c))	e = 0x10001	d = inverse(e, E.order())	G = d*P	return long_to_bytes(int(G[0]))
F = GF(p)E = EllipticCurve(F, [1,2])key = E.j_invariant()
p1 = decrypt(c1, 0)p2 = decrypt(c2, key)
print(p1 + p2)```
**CHTB{Counting_points_with_Schoofs_algorithm}**