[Given Data]

<super-metroid.sage>
```
from Crypto.Util.number import bytes_to_long, getPrime
from secrets import FLAG

def gen_key():
from secrets import a,b
E1 = EllipticCurve(F, [a,b])
assert E.is_isomorphic(E1)
key = - F(1728) * F(4*a)^3 / F(E1.discriminant())
return key

def encrypt(message, key):
m = bytes_to_long(message)
e = 0x10001
G = E.lift_x(Integer(m))
P = e*G
return int(P[0])^^int(key)

p = getPrime(256)
F = GF(p)
E = EllipticCurve(F, [1,2])
key = gen_key()

c1 = encrypt(FLAG[:22], 0)
c2 = encrypt(FLAG[22:], key)

print(f'p = {p}')
print(f'c1 = {c1}')
print(f'c2 = {c2}')
```

<output.txt>
```
p = 103286641759600285797850797617629977324547405479993669860676630672349238970323
c1 = 39515350190224022595423324336682561295008443386321945222926612155252852069385
c2 = 102036897442608703406754776248651511553323754723619976410650252804157884591552
```

[Solution]

The* key *is j-invariant of E1.
It is equals to j-invariant of E because E and E1 are isomorphic.

<solve.sage>
```
from Crypto.Util.number import inverse, long_to_bytes

p = 103286641759600285797850797617629977324547405479993669860676630672349238970323
c1 = 39515350190224022595423324336682561295008443386321945222926612155252852069385
c2 = 102036897442608703406754776248651511553323754723619976410650252804157884591552

def decrypt(ct, key):
c = int(ct)^^int(key)
P = E.lift_x(Integer(c))
e = 0x10001
d = inverse(e, E.order())
G = d*P
return long_to_bytes(int(G[0]))

F = GF(p)
E = EllipticCurve(F, [1,2])
key = E.j_invariant()

p1 = decrypt(c1, 0)
p2 = decrypt(c2, key)

print(p1 + p2)
```

**CHTB{Counting_points_with_Schoofs_algorithm}**