@Test
  public void monitorsWithAnnotation_correctKeyIsAssociated() throws Exception {
    FakeMonitoringClient fakeMonitoringClient = new FakeMonitoringClient();
    MutableMonitoringRegistry.globalInstance().clear();
    MutableMonitoringRegistry.globalInstance().registerMonitoringClient(fakeMonitoringClient);
    HybridDecryptWrapper.register();

    MonitoringAnnotations annotations =
        MonitoringAnnotations.newBuilder().add("annotation_name", "annotation_value").build();
    HpkeParameters parameters =
        HpkeParameters.builder()
            .setVariant(HpkeParameters.Variant.TINK)
            .setKemId(HpkeParameters.KemId.DHKEM_P256_HKDF_SHA256)
            .setKdfId(HpkeParameters.KdfId.HKDF_SHA256)
            .setAeadId(HpkeParameters.AeadId.AES_256_GCM)
            .build();

    KeysetHandle handle =
        KeysetHandle.newBuilder()
            .addEntry(
                KeysetHandle.generateEntryFromParameters(
                        HpkeParameters.builder()
                            .setVariant(HpkeParameters.Variant.NO_PREFIX)
                            .setKemId(HpkeParameters.KemId.DHKEM_P256_HKDF_SHA256)
                            .setKdfId(HpkeParameters.KdfId.HKDF_SHA256)
                            .setAeadId(HpkeParameters.AeadId.AES_256_GCM)
                            .build())
                    .withFixedId(100))
            .addEntry(
                KeysetHandle.generateEntryFromParameters(parameters).withFixedId(200).makePrimary())
            .addEntry(KeysetHandle.generateEntryFromParameters(parameters).withFixedId(300))
            .setMonitoringAnnotations(annotations)
            .build();

    HybridDecrypt decrypter = handle.getPrimitive(HybridDecrypt.class);
    HybridEncrypt encrypter0 =
        HpkeEncrypt.create((HpkePublicKey) handle.getPublicKeysetHandle().getAt(0).getKey());
    HybridEncrypt encrypter1 =
        HpkeEncrypt.create((HpkePublicKey) handle.getPublicKeysetHandle().getAt(1).getKey());
    byte[] context = "context".getBytes(UTF_8);
    byte[] ciphertext0 = encrypter0.encrypt(new byte[100], context);
    Object unused = decrypter.decrypt(ciphertext0, context);
    byte[] ciphertext1 = encrypter1.encrypt(new byte[200], context);
    unused = decrypter.decrypt(ciphertext1, context);

    List<FakeMonitoringClient.LogEntry> logEntries = fakeMonitoringClient.getLogEntries();
    assertThat(logEntries).hasSize(2);
    FakeMonitoringClient.LogEntry signEntry0 = logEntries.get(0);
    assertThat(signEntry0.getKeyId()).isEqualTo(100);
    assertThat(signEntry0.getPrimitive()).isEqualTo("hybrid_decrypt");
    assertThat(signEntry0.getApi()).isEqualTo("decrypt");
    assertThat(signEntry0.getNumBytesAsInput()).isEqualTo(ciphertext0.length);
    assertThat(signEntry0.getKeysetInfo().getAnnotations()).isEqualTo(annotations);

    FakeMonitoringClient.LogEntry signEntry1 = logEntries.get(1);
    assertThat(signEntry1.getKeyId()).isEqualTo(200);
    assertThat(signEntry1.getPrimitive()).isEqualTo("hybrid_decrypt");
    assertThat(signEntry1.getApi()).isEqualTo("decrypt");
    assertThat(signEntry1.getNumBytesAsInput()).isEqualTo(ciphertext1.length);
    assertThat(signEntry1.getKeysetInfo().getAnnotations()).isEqualTo(annotations);
  }
This test checks that we decrypt ciphertext even if it is encrypted under a NO_PREFIX
non-primary, the primary is a Tink prefix primary, and the ciphertext matches the prefix by a
2^(-40) probability coincidence.
java_src/src/test/java/com/google/crypto/tink/hybrid/HybridDecryptWrapperTest.java