@Test
  public void decrypt_rawCiphertextLookingLikeTinkCiphertext_createTest() throws Exception {
    // We are using LEGACY_UNCOMPRESSED because we can make the ciphertext start with 0x01 for this.
    EciesParameters parameters =
        EciesParameters.builder()
            .setCurveType(EciesParameters.CurveType.NIST_P256)
            .setHashType(EciesParameters.HashType.SHA256)
            .setNistCurvePointFormat(EciesParameters.PointFormat.LEGACY_UNCOMPRESSED)
            .setVariant(EciesParameters.Variant.NO_PREFIX)
            .setDemParameters(
                AesGcmParameters.builder()
                    .setIvSizeBytes(12)
                    .setKeySizeBytes(16)
                    .setTagSizeBytes(16)
                    .setVariant(AesGcmParameters.Variant.NO_PREFIX)
                    .build())
            .build();
    EciesPublicKey publicKey =
        EciesPublicKey.createForNistCurve(
            parameters,
            new ECPoint(
                new BigInteger(
                    "cc38c424b8c88e0d5726e0b05017b597e92c3dd8be412a458d12172180c6badd", 16),
                new BigInteger(
                    "6ef995bf8e6a392dd038d0543b6f57f3e2283d0dc3a1c470faf6d4d0299ad80e", 16)),
            /* idRequirement= */ null);
    // This is now a private key for which we have a known ciphertext which starts with "0x01".
    EciesPrivateKey privateKey =
        EciesPrivateKey.createForNistCurve(
            publicKey,
            SecretBigInteger.fromBigInteger(
                new BigInteger(
                    "57bd0131ccab56735932597e9414c4e9f6ed4a2d780f93d7d03573023100de5e", 16),
                InsecureSecretKeyAccess.get()));
    // We verify the above claim first to make sure the test is correct.
    byte[] message = "data".getBytes(UTF_8);
    byte[] context = "context".getBytes(UTF_8);
    byte[] ciphertext =
        Hex.decode(
            "01ae4755bd"
                + "66be54fdbfc60907e1ba0801dcc2f9a25c049f8fe1c2578d509019d048fd9dd2718b9b940711c0"
                + "10b86ca28786eb5a7b93da42ccd2ac950ea2614295f1bd6b0ad91e0369044ecfdd2fae8f31811472"
                + "426e4410fce68191f2cfe5aa");
    {
      HybridDecrypt decrypt = EciesAeadHkdfHybridDecrypt.create(privateKey);
      assertThat(decrypt.decrypt(ciphertext, context)).isEqualTo(message);
    }
    HpkeParameters tinkHpkeParameters =
        HpkeParameters.builder()
            .setVariant(HpkeParameters.Variant.TINK)
            .setKemId(HpkeParameters.KemId.DHKEM_P256_HKDF_SHA256)
            .setKdfId(HpkeParameters.KdfId.HKDF_SHA256)
            .setAeadId(HpkeParameters.AeadId.AES_256_GCM)
            .build();

    KeysetHandle handle =
        KeysetHandle.newBuilder()
            .addEntry(
                KeysetHandle.generateEntryFromParameters(tinkHpkeParameters)
                    .withFixedId(0xae4755bd)
                    .makePrimary())
            .addEntry(KeysetHandle.importKey(privateKey).withRandomId())
            .build();

    HybridDecrypt keysetHandleDecrypt = handle.getPrimitive(HybridDecrypt.class);
    assertThat(keysetHandleDecrypt.decrypt(ciphertext, context)).isEqualTo(message);

    HybridEncrypt encrypt = handle.getPublicKeysetHandle().getPrimitive(HybridEncrypt.class);
    byte[] primaryCiphertext = encrypt.encrypt(message, context);
    assertThat(keysetHandleDecrypt.decrypt(primaryCiphertext, context)).isEqualTo(message);
    assertThat(isPrefix(Hex.decode("01ae4755bd"), primaryCiphertext)).isTrue();
  }
This test checks that we decrypt ciphertext even if it is encrypted under a NO_PREFIX
non-primary, the primary is a Tink prefix primary, and the ciphertext matches the prefix by a
2^(-40) probability coincidence.
java_src/src/test/java/com/google/crypto/tink/hybrid/HybridDecryptWrapperTest.java