tldr;
- send $(a,b,c,d) = (m, m^{-1}, t, -1)$
- this makes it easy to distinguish what the two key bits are from the given $(x, y, z)$

[writeup](https://jsur.in/posts/2021-03-07-zer0pts-ctf-2021-crypto-writeups#ot-or-not-ot)

Original writeup (https://jsur.in/posts/2021-03-07-zer0pts-ctf-2021-crypto-writeups#ot-or-not-ot).