Rating:
We can solve the discrete log problem because the order of the elliptic curve generated on the server is small.
[writeup](https://ptr-yudai.hatenablog.com/entry/2019/06/03/113943#crypto-919pts-storagespace)
I don't remember
