We have access to a decryption oracle, but the algorithm used is AES-GCM. The oracle indicates if the message is valid or not. The queries are very limited so we can use a partitionning oracle to reduce the number of queries and recover the keys.

Original writeup (https://blog.oppida.apave.com/en/Nos-articles/Google-CTF-2021-Pythia).