Key-Generation

An RSA modulus that looks 2054-bit-strong is actually 67 × q — a tiny prime factor makes it trivially factorable (FactorDB / trial division), reconstructing the private key and decrypting the flag.