# Source:```from ecdsa import ellipticcurve as eccfrom random import randint
a = -35b = 98p = 434252269029337012720086440207Gx = 16378704336066569231287640165Gy = 377857010369614774097663166640ec_order = 434252269029337012720086440208
E = ecc.CurveFp(p, a, b)G = ecc.Point(E, Gx, Gy, ec_order)
def generateKeyPair():    private = randint(1, 2**64)    public = G * private    return(public, private)
def checkDestinationPoint(data: dict, P: ecc.Point, nQ: int, E: ecc.CurveFp) -> list:    destination_x, destination_y = checkCoordinates(data)    destination_point = ecc.Point(E, destination_x, destination_y, ec_order)    secret_point = P * nQ    same_x = destination_point.x() == secret_point.x()    same_y = destination_point.y() == secret_point.y()
    if (same_x and same_y):        return True    else:        return False```
# Solve:We get given two points on a curve $P(x, y)$ and $Q(x, y)$ and are asked to find the value of $P \times nQ$, something ideally computationally impossible without knowledge of the private key $n$. In the source code we find the curve parameters $a$ and $b$ , and the generator point $G$. From the name we can summise that this is a MOV attack challenge. the idea behind the MOV attack is avoid compution the incredibly hard Elliptic Curve DLP(discrete logarithm problem) by shifting (or moving ... get it?) the group from a group of points on an eliptic curve to a finite feild, and then solve the now finite feild DLP there.
To do this, the embedding degree $(k)$ of the curve must be small, specifically $k \le 6$. From experimentation we find that the embedding degree of this curve is well within that range as $k=2$ . From here, we can use a standard MOV attack sage implementation (I used one i had made previously), and solve.
### Solve Script:``` pythona = -35b = 98p = 434252269029337012720086440207E = EllipticCurve(GF(p), [a,b])
G = E(16378704336066569231287640165, 377857010369614774097663166640)A = E(int("0x54b35f407996eb8fc566d3b12", 16), int("0xc857b1b70d5ef09507bf8bd6", 16))B = E(int("0x22afe63536a534077df811f1e", 16), int("0x16cd192948520687a521ae471",16))
order = G.order()k = 1while (p**k - 1) % order:    k += 1print(k)
Ee = EllipticCurve(GF(p^k, 'y'), [a, b])Ge = Ee(G)Ae = Ee(A)
T = Ee.random_point()M = T.order()d = gcd(M, G.order())Q = (M//d)*T
assert G.order() / Q.order() in ZZ
N = G.order()
a = Ge.weil_pairing(Q, N)b = Ae.weil_pairing(Q, N)
na = b.log(a)S = na*B
print(f"x: {hex(S.xy()[0])}")print(f"y: {hex(S.xy()[1])}")```
```x: 0x456d53f3f1738a1d78429dc1by: 0x541ac0a09249f717fd9737f8f```
#### Flag: `HTB{I7_5h0075_,1t_m0v5,_wh47_15_i7?}`