#!/usr/bin/env python3
"""Offline recovery for REWIND — XOR secret_ct with a zero-plaintext keystream."""

SECRET_CT = bytes.fromhex(
    "838639e02c3029abef3e5e415f5c558326b813a7f983d28ef4b6761be98321e1"
    "a2eb7210a1a69a6357b80138"
)  # 44 bytes (88 hex chars in banner)
KEYSTREAM = bytes.fromhex(
    "f9e2529b5e555ec7a15a372f180321cb43e750e8aceda6eb86e90428bcd044d"
    "4fd9f3a75fed5ad31328c6c45a9"
)  # 45 bytes returned for 45 zero-byte plaintext; only first 44 used


def recover_flag(secret_ct: bytes, keystream: bytes) -> bytes:
    return bytes(a ^ b for a, b in zip(secret_ct, keystream))


def main() -> None:
    flag = recover_flag(SECRET_CT, KEYSTREAM)
    print(flag.decode())


if __name__ == "__main__":
    main()