Simple challenge, there are two key point to solve this. First, the order of the curve is smooth, and also the private keys are relatively small ($2 ^ {64}$). My approach is just simply relying on Sage magic to perform the heavy duty work. Sage Implementation: from Crypto.Cipher import AES from Crypto.Util.Padding import pad, unpad import hashlib def gen_shared_secret(P, n): S = n * P return S.xy()[0] p = 99061670249353652702595159229088680425828208953931838069069584252923270946291 a = 1 b = 4 E = EllipticCurve(GF(p), [a,b]) ax = 87360200456784002948566700858113190957688355783112995047798140117594305287669 bx = 6082896373499126624029343293750138460137531774473450341235217699497602895121 A = E.