tldr;
- keep reconnecting until we get a good set of parameters $(g, x, p)$
- suppose $x$ is even and $2$ is a quadratic residue mod $p$ and $3$ is a quadratic nonresidue mod $p$
- we can distinguish yoshiking whether yoshiking choose paper or not by checking whether $c_2$ is a quadratic residue mod $p$
- since nothing happens if we draw, if yoshiking doesn't choose paper, just choose rock as we will either win or draw doing this

[writeup](https://jsur.in/posts/2021-03-07-zer0pts-ctf-2021-crypto-writeups#janken)

Original writeup (https://jsur.in/posts/2021-03-07-zer0pts-ctf-2021-crypto-writeups#janken).