[Original writeup](https://toranova.xyz/scompute/?p=225)

tldr

theorem 16 in [https://www.math.uni-frankfurt.de/~dmst/teaching/SS2012/Vorlesung/Point.Stern.pdf](https://www.math.uni-frankfurt.de/~dmst/teaching/SS2012/Vorlesung/Point.Stern.pdf) shows us how to forge elgamal signatures.

then, notice that the conditional check to print the flag only requires that "Felicity" or "Cisco" or "both" to be part of the answer_bytes. The verification also masks anything above 1024 bits, or 128-bytes. This means we can just prepend the hex representation of either "Felicity" or "Cisco" or "both" to our the hex representation of the forged random message.

m, r, s = eforge(p, g, y)

ah = hex('both') + hex(m)

send, ah, r and s to verifier.