TLDR

Check that the elliptic curve in the ECDH is supersingular.

Supersingular elliptic curves are unsafe for ECDH as they have a small embedding degree.

With embedding degree 2, implement the MOV attack and solve the dlog on a multiplicative group.

More in [https://sectt.github.io/writeups/Volga20/crypto_keygreed/README](https://sectt.github.io/writeups/Volga20/crypto_keygreed/README)