Crypto

A commit-reveal rock-paper-scissors whose non-binding sha256(r1 + message + r2) commitment lets you open one hash to any winning move and sweep all 100 rounds.

A P-521 ECDSA oracle derives its nonce from an MD5-based uuid3, so an MD5 collision forces nonce reuse, leaks the private key, and lets us forge a signature for the flag.