// Copyright 2015-2020 Parity Technologies (UK) Ltd.
// This file is part of OpenEthereum.

// OpenEthereum is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.

// OpenEthereum is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.

// You should have received a copy of the GNU General Public License
// along with OpenEthereum.  If not, see <http://www.gnu.org/licenses/>.

use ethereum_types::{H256, U256};
use ethkey::{math, Generator, Public, Random, Secret, Signature};
use hash::keccak;
use key_server_cluster::Error;

/// Encryption result.
#[derive(Debug)]
pub struct EncryptedSecret {
    /// Common encryption point.
    pub common_point: Public,
    /// Ecnrypted point.
    pub encrypted_point: Public,
}

/// Create zero scalar.
pub fn zero_scalar() -> Secret {
    Secret::zero()
}

/// Convert hash to EC scalar (modulo curve order).
pub fn to_scalar(hash: H256) -> Result<Secret, Error> {
    let scalar: U256 = hash.into();
    let scalar: H256 = (scalar % math::curve_order()).into();
    let scalar = Secret::from(scalar.0);
    scalar.check_validity()?;
    Ok(scalar)
}

/// Generate random scalar.
pub fn generate_random_scalar() -> Result<Secret, Error> {
    Ok(Random.generate()?.secret().clone())
}

/// Generate random point.
pub fn generate_random_point() -> Result<Public, Error> {
    Ok(Random.generate()?.public().clone())
}

/// Get X coordinate of point.
fn public_x(public: &Public) -> H256 {
    public[0..32].into()
}

/// Get Y coordinate of point.
fn public_y(public: &Public) -> H256 {
    public[32..64].into()
}

/// Compute publics sum.
pub fn compute_public_sum<'a, I>(mut publics: I) -> Result<Public, Error>
where
    I: Iterator<Item = &'a Public>,
{
    let mut sum = publics
        .next()
        .expect("compute_public_sum is called when there's at least one public; qed")
        .clone();
    while let Some(public) = publics.next() {
        math::public_add(&mut sum, &public)?;
    }
    Ok(sum)
}

/// Compute secrets sum.
pub fn compute_secret_sum<'a, I>(mut secrets: I) -> Result<Secret, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    let mut sum = secrets
        .next()
        .expect("compute_secret_sum is called when there's at least one secret; qed")
        .clone();
    while let Some(secret) = secrets.next() {
        sum.add(secret)?;
    }
    Ok(sum)
}

/// Compute secrets multiplication.
pub fn compute_secret_mul(secret1: &Secret, secret2: &Secret) -> Result<Secret, Error> {
    let mut secret_mul = secret1.clone();
    secret_mul.mul(secret2)?;
    Ok(secret_mul)
}

/// Compute secrets 'shadow' multiplication: coeff * multiplication(s[j] / (s[i] - s[j])) for every i != j
pub fn compute_shadow_mul<'a, I>(
    coeff: &Secret,
    self_secret: &Secret,
    mut other_secrets: I,
) -> Result<Secret, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    // when there are no other secrets, only coeff is left
    let other_secret = match other_secrets.next() {
        Some(other_secret) => other_secret,
        None => return Ok(coeff.clone()),
    };

    let mut shadow_mul = self_secret.clone();
    shadow_mul.sub(other_secret)?;
    shadow_mul.inv()?;
    shadow_mul.mul(other_secret)?;
    while let Some(other_secret) = other_secrets.next() {
        let mut shadow_mul_element = self_secret.clone();
        shadow_mul_element.sub(other_secret)?;
        shadow_mul_element.inv()?;
        shadow_mul_element.mul(other_secret)?;
        shadow_mul.mul(&shadow_mul_element)?;
    }

    shadow_mul.mul(coeff)?;
    Ok(shadow_mul)
}

/// Update point by multiplying to random scalar
pub fn update_random_point(point: &mut Public) -> Result<(), Error> {
    Ok(math::public_mul_secret(point, &generate_random_scalar()?)?)
}

/// Generate random polynom of threshold degree
pub fn generate_random_polynom(threshold: usize) -> Result<Vec<Secret>, Error> {
    (0..threshold + 1)
        .map(|_| generate_random_scalar())
        .collect()
}

/// Compute value of polynom, using `node_number` as argument
pub fn compute_polynom(polynom: &[Secret], node_number: &Secret) -> Result<Secret, Error> {
    debug_assert!(!polynom.is_empty());

    let mut result = polynom[0].clone();
    for i in 1..polynom.len() {
        // calculate pow(node_number, i)
        let mut appendum = node_number.clone();
        appendum.pow(i)?;

        // calculate coeff * pow(point, i)
        appendum.mul(&polynom[i])?;

        // calculate result + coeff * pow(point, i)
        result.add(&appendum)?;
    }

    Ok(result)
}

/// Generate public keys for other participants.
pub fn public_values_generation(
    threshold: usize,
    derived_point: &Public,
    polynom1: &[Secret],
    polynom2: &[Secret],
) -> Result<Vec<Public>, Error> {
    debug_assert_eq!(polynom1.len(), threshold + 1);
    debug_assert_eq!(polynom2.len(), threshold + 1);

    // compute t+1 public values
    let mut publics = Vec::with_capacity(threshold + 1);
    for i in 0..threshold + 1 {
        let coeff1 = &polynom1[i];

        let mut multiplication1 = math::generation_point();
        math::public_mul_secret(&mut multiplication1, &coeff1)?;

        let coeff2 = &polynom2[i];
        let mut multiplication2 = derived_point.clone();
        math::public_mul_secret(&mut multiplication2, &coeff2)?;

        math::public_add(&mut multiplication1, &multiplication2)?;

        publics.push(multiplication1);
    }
    debug_assert_eq!(publics.len(), threshold + 1);

    Ok(publics)
}

/// Check keys passed by other participants.
pub fn keys_verification(
    threshold: usize,
    derived_point: &Public,
    number_id: &Secret,
    secret1: &Secret,
    secret2: &Secret,
    publics: &[Public],
) -> Result<bool, Error> {
    // calculate left part
    let mut multiplication1 = math::generation_point();
    math::public_mul_secret(&mut multiplication1, secret1)?;

    let mut multiplication2 = derived_point.clone();
    math::public_mul_secret(&mut multiplication2, secret2)?;

    math::public_add(&mut multiplication1, &multiplication2)?;
    let left = multiplication1;

    // calculate right part
    let mut right = publics[0].clone();
    for i in 1..threshold + 1 {
        let mut secret_pow = number_id.clone();
        secret_pow.pow(i)?;

        let mut public_k = publics[i].clone();
        math::public_mul_secret(&mut public_k, &secret_pow)?;

        math::public_add(&mut right, &public_k)?;
    }

    Ok(left == right)
}

/// Compute secret subshare from passed secret value.
pub fn compute_secret_subshare<'a, I>(
    threshold: usize,
    secret_value: &Secret,
    sender_id_number: &Secret,
    other_id_numbers: I,
) -> Result<Secret, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    let mut subshare = compute_shadow_mul(secret_value, sender_id_number, other_id_numbers)?;
    if threshold % 2 != 0 {
        subshare.neg()?;
    }

    Ok(subshare)
}

/// Compute secret share.
pub fn compute_secret_share<'a, I>(secret_values: I) -> Result<Secret, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    compute_secret_sum(secret_values)
}

/// Compute public key share.
pub fn compute_public_share(self_secret_value: &Secret) -> Result<Public, Error> {
    let mut public_share = math::generation_point();
    math::public_mul_secret(&mut public_share, self_secret_value)?;
    Ok(public_share)
}

/// Compute joint public key.
pub fn compute_joint_public<'a, I>(public_shares: I) -> Result<Public, Error>
where
    I: Iterator<Item = &'a Public>,
{
    compute_public_sum(public_shares)
}

/// Compute joint secret key from N secret coefficients.
#[cfg(test)]
pub fn compute_joint_secret<'a, I>(secret_coeffs: I) -> Result<Secret, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    compute_secret_sum(secret_coeffs)
}

/// Compute joint secret key from t+1 secret shares.
pub fn compute_joint_secret_from_shares<'a>(
    t: usize,
    secret_shares: &[&'a Secret],
    id_numbers: &[&'a Secret],
) -> Result<Secret, Error> {
    let secret_share_0 = secret_shares[0];
    let id_number_0 = id_numbers[0];
    let other_nodes_numbers = id_numbers.iter().skip(1).cloned();
    let mut result = compute_node_shadow(secret_share_0, id_number_0, other_nodes_numbers)?;
    for i in 1..secret_shares.len() {
        let secret_share_i = secret_shares[i];
        let id_number_i = id_numbers[i];
        let other_nodes_numbers = id_numbers
            .iter()
            .enumerate()
            .filter(|&(j, _)| j != i)
            .map(|(_, n)| n)
            .cloned();
        let addendum = compute_node_shadow(secret_share_i, id_number_i, other_nodes_numbers)?;
        result.add(&addendum)?;
    }

    if t % 2 != 0 {
        result.neg()?;
    }

    Ok(result)
}

/// Encrypt secret with joint public key.
pub fn encrypt_secret(secret: &Public, joint_public: &Public) -> Result<EncryptedSecret, Error> {
    // this is performed by KS-cluster client (or KS master)
    let key_pair = Random.generate()?;

    // k * T
    let mut common_point = math::generation_point();
    math::public_mul_secret(&mut common_point, key_pair.secret())?;

    // M + k * y
    let mut encrypted_point = joint_public.clone();
    math::public_mul_secret(&mut encrypted_point, key_pair.secret())?;
    math::public_add(&mut encrypted_point, secret)?;

    Ok(EncryptedSecret {
        common_point: common_point,
        encrypted_point: encrypted_point,
    })
}

/// Compute shadow for the node.
pub fn compute_node_shadow<'a, I>(
    node_secret_share: &Secret,
    node_number: &Secret,
    other_nodes_numbers: I,
) -> Result<Secret, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    compute_shadow_mul(node_secret_share, node_number, other_nodes_numbers)
}

/// Compute shadow point for the node.
pub fn compute_node_shadow_point(
    access_key: &Secret,
    common_point: &Public,
    node_shadow: &Secret,
    decrypt_shadow: Option<Secret>,
) -> Result<(Public, Option<Secret>), Error> {
    let mut shadow_key = node_shadow.clone();
    let decrypt_shadow = match decrypt_shadow {
        None => None,
        Some(mut decrypt_shadow) => {
            // update shadow key
            shadow_key.mul(&decrypt_shadow)?;
            // now udate decrypt shadow itself
            decrypt_shadow.dec()?;
            decrypt_shadow.mul(node_shadow)?;
            Some(decrypt_shadow)
        }
    };
    shadow_key.mul(access_key)?;

    let mut node_shadow_point = common_point.clone();
    math::public_mul_secret(&mut node_shadow_point, &shadow_key)?;
    Ok((node_shadow_point, decrypt_shadow))
}

/// Compute joint shadow point.
pub fn compute_joint_shadow_point<'a, I>(nodes_shadow_points: I) -> Result<Public, Error>
where
    I: Iterator<Item = &'a Public>,
{
    compute_public_sum(nodes_shadow_points)
}

/// Compute joint shadow point (version for tests).
#[cfg(test)]
pub fn compute_joint_shadow_point_test<'a, I>(
    access_key: &Secret,
    common_point: &Public,
    nodes_shadows: I,
) -> Result<Public, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    let mut joint_shadow = compute_secret_sum(nodes_shadows)?;
    joint_shadow.mul(access_key)?;

    let mut joint_shadow_point = common_point.clone();
    math::public_mul_secret(&mut joint_shadow_point, &joint_shadow)?;
    Ok(joint_shadow_point)
}

/// Decrypt data using joint shadow point.
pub fn decrypt_with_joint_shadow(
    threshold: usize,
    access_key: &Secret,
    encrypted_point: &Public,
    joint_shadow_point: &Public,
) -> Result<Public, Error> {
    let mut inv_access_key = access_key.clone();
    inv_access_key.inv()?;

    let mut mul = joint_shadow_point.clone();
    math::public_mul_secret(&mut mul, &inv_access_key)?;

    let mut decrypted_point = encrypted_point.clone();
    if threshold % 2 != 0 {
        math::public_add(&mut decrypted_point, &mul)?;
    } else {
        math::public_sub(&mut decrypted_point, &mul)?;
    }

    Ok(decrypted_point)
}

/// Prepare common point for shadow decryption.
pub fn make_common_shadow_point(
    threshold: usize,
    mut common_point: Public,
) -> Result<Public, Error> {
    if threshold % 2 != 1 {
        Ok(common_point)
    } else {
        math::public_negate(&mut common_point)?;
        Ok(common_point)
    }
}

/// Decrypt shadow-encrypted secret.
#[cfg(test)]
pub fn decrypt_with_shadow_coefficients(
    mut decrypted_shadow: Public,
    mut common_shadow_point: Public,
    shadow_coefficients: Vec<Secret>,
) -> Result<Public, Error> {
    let shadow_coefficients_sum = compute_secret_sum(shadow_coefficients.iter())?;
    math::public_mul_secret(&mut common_shadow_point, &shadow_coefficients_sum)?;
    math::public_add(&mut decrypted_shadow, &common_shadow_point)?;
    Ok(decrypted_shadow)
}

/// Decrypt data using joint secret (version for tests).
#[cfg(test)]
pub fn decrypt_with_joint_secret(
    encrypted_point: &Public,
    common_point: &Public,
    joint_secret: &Secret,
) -> Result<Public, Error> {
    let mut common_point_mul = common_point.clone();
    math::public_mul_secret(&mut common_point_mul, joint_secret)?;

    let mut decrypted_point = encrypted_point.clone();
    math::public_sub(&mut decrypted_point, &common_point_mul)?;

    Ok(decrypted_point)
}

/// Combine message hash with public key X coordinate.
pub fn combine_message_hash_with_public(
    message_hash: &H256,
    public: &Public,
) -> Result<Secret, Error> {
    // buffer is just [message_hash | public.x]
    let mut buffer = [0; 64];
    buffer[0..32].copy_from_slice(&message_hash[0..32]);
    buffer[32..64].copy_from_slice(&public[0..32]);

    // calculate hash of buffer
    let hash = keccak(&buffer[..]);

    // map hash to EC finite field value
    to_scalar(hash)
}

/// Compute Schnorr signature share.
pub fn compute_schnorr_signature_share<'a, I>(
    threshold: usize,
    combined_hash: &Secret,
    one_time_secret_coeff: &Secret,
    node_secret_share: &Secret,
    node_number: &Secret,
    other_nodes_numbers: I,
) -> Result<Secret, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    let mut sum = one_time_secret_coeff.clone();
    let mut subtrahend = compute_shadow_mul(combined_hash, node_number, other_nodes_numbers)?;
    subtrahend.mul(node_secret_share)?;
    if threshold % 2 == 0 {
        sum.sub(&subtrahend)?;
    } else {
        sum.add(&subtrahend)?;
    }
    Ok(sum)
}

/// Check Schnorr signature share.
pub fn _check_schnorr_signature_share<'a, I>(
    _combined_hash: &Secret,
    _signature_share: &Secret,
    _public_share: &Public,
    _one_time_public_share: &Public,
    _node_numbers: I,
) -> Result<bool, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    // TODO [Trust]: in paper partial signature is checked using comparison:
    //    sig[i] * T                                  = r[i] - c * lagrange_coeff(i) * y[i]
    // => (k[i] - c * lagrange_coeff(i) * s[i]) * T   = r[i] - c * lagrange_coeff(i) * y[i]
    // => k[i] * T - c * lagrange_coeff(i) * s[i] * T = k[i] * T - c * lagrange_coeff(i) * y[i]
    // => this means that y[i] = s[i] * T
    // but when verifying signature (for t = 1), nonce public (r) is restored using following expression:
    // r = (sig[0] + sig[1]) * T - c * y
    // r = (k[0] - c * lagrange_coeff(0) * s[0] + k[1] - c * lagrange_coeff(1) * s[1]) * T - c * y
    // r = (k[0] + k[1]) * T - c * (lagrange_coeff(0) * s[0] + lagrange_coeff(1) * s[1]) * T - c * y
    // r = r - c * (lagrange_coeff(0) * s[0] + lagrange_coeff(1) * s[1]) * T - c * y
    // => -c * y = c * (lagrange_coeff(0) * s[0] + lagrange_coeff(1) * s[1]) * T
    // => -y = (lagrange_coeff(0) * s[0] + lagrange_coeff(1) * s[1]) * T
    // => y[i] != s[i] * T
    // => some other way is required
    Ok(true)
}

/// Compute Schnorr signature.
pub fn compute_schnorr_signature<'a, I>(signature_shares: I) -> Result<Secret, Error>
where
    I: Iterator<Item = &'a Secret>,
{
    compute_secret_sum(signature_shares)
}

/// Locally compute Schnorr signature as described in https://en.wikipedia.org/wiki/Schnorr_signature#Signing.
#[cfg(test)]
pub fn local_compute_schnorr_signature(
    nonce: &Secret,
    secret: &Secret,
    message_hash: &Secret,
) -> Result<(Secret, Secret), Error> {
    let mut nonce_public = math::generation_point();
    math::public_mul_secret(&mut nonce_public, &nonce).unwrap();

    let combined_hash = combine_message_hash_with_public(message_hash, &nonce_public)?;

    let mut sig_subtrahend = combined_hash.clone();
    sig_subtrahend.mul(secret)?;
    let mut sig = nonce.clone();
    sig.sub(&sig_subtrahend)?;

    Ok((combined_hash, sig))
}

/// Verify Schnorr signature as described in https://en.wikipedia.org/wiki/Schnorr_signature#Verifying.
#[cfg(test)]
pub fn verify_schnorr_signature(
    public: &Public,
    signature: &(Secret, Secret),
    message_hash: &H256,
) -> Result<bool, Error> {
    let mut addendum = math::generation_point();
    math::public_mul_secret(&mut addendum, &signature.1)?;
    let mut nonce_public = public.clone();
    math::public_mul_secret(&mut nonce_public, &signature.0)?;
    math::public_add(&mut nonce_public, &addendum)?;

    let combined_hash = combine_message_hash_with_public(message_hash, &nonce_public)?;
    Ok(combined_hash == signature.0)
}

/// Compute R part of ECDSA signature.
pub fn compute_ecdsa_r(nonce_public: &Public) -> Result<Secret, Error> {
    to_scalar(public_x(nonce_public))
}

/// Compute share of S part of ECDSA signature.
pub fn compute_ecdsa_s_share(
    inv_nonce_share: &Secret,
    inv_nonce_mul_secret: &Secret,
    signature_r: &Secret,
    message_hash: &Secret,
) -> Result<Secret, Error> {
    let mut nonce_inv_share_mul_message_hash = inv_nonce_share.clone();
    nonce_inv_share_mul_message_hash.mul(&message_hash.clone().into())?;

    let mut nonce_inv_share_mul_secret_share_mul_r = inv_nonce_mul_secret.clone();
    nonce_inv_share_mul_secret_share_mul_r.mul(signature_r)?;

    let mut signature_s_share = nonce_inv_share_mul_message_hash;
    signature_s_share.add(&nonce_inv_share_mul_secret_share_mul_r)?;

    Ok(signature_s_share)
}

/// Compute S part of ECDSA signature from shares.
pub fn compute_ecdsa_s(
    t: usize,
    signature_s_shares: &[Secret],
    id_numbers: &[Secret],
) -> Result<Secret, Error> {
    let double_t = t * 2;
    debug_assert!(id_numbers.len() >= double_t + 1);
    debug_assert_eq!(signature_s_shares.len(), id_numbers.len());

    compute_joint_secret_from_shares(
        double_t,
        &signature_s_shares
            .iter()
            .take(double_t + 1)
            .collect::<Vec<_>>(),
        &id_numbers.iter().take(double_t + 1).collect::<Vec<_>>(),
    )
}

/// Serialize ECDSA signature to [r][s]v form.
pub fn serialize_ecdsa_signature(
    nonce_public: &Public,
    signature_r: Secret,
    mut signature_s: Secret,
) -> Signature {
    // compute recovery param
    let mut signature_v = {
        let nonce_public_x = public_x(nonce_public);
        let nonce_public_y: U256 = public_y(nonce_public).into();
        let nonce_public_y_is_odd = !(nonce_public_y % 2).is_zero();
        let bit0 = if nonce_public_y_is_odd { 1u8 } else { 0u8 };
        let bit1 = if nonce_public_x != *signature_r {
            2u8
        } else {
            0u8
        };
        bit0 | bit1
    };

    // fix high S
    let curve_order = math::curve_order();
    let curve_order_half = curve_order / 2;
    let s_numeric: U256 = (*signature_s).into();
    if s_numeric > curve_order_half {
        let signature_s_hash: H256 = (curve_order - s_numeric).into();
        signature_s = signature_s_hash.into();
        signature_v ^= 1;
    }

    // serialize as [r][s]v
    let mut signature = [0u8; 65];
    signature[..32].copy_from_slice(&**signature_r);
    signature[32..64].copy_from_slice(&**signature_s);
    signature[64] = signature_v;

    signature.into()
}

/// Compute share of ECDSA reversed-nonce coefficient. Result of this_coeff * secret_share gives us a share of inv(nonce).
pub fn compute_ecdsa_inversed_secret_coeff_share(
    secret_share: &Secret,
    nonce_share: &Secret,
    zero_share: &Secret,
) -> Result<Secret, Error> {
    let mut coeff = secret_share.clone();
    coeff.mul(nonce_share).unwrap();
    coeff.add(zero_share).unwrap();
    Ok(coeff)
}

/// Compute ECDSA reversed-nonce coefficient from its shares. Result of this_coeff * secret_share gives us a share of inv(nonce).
pub fn compute_ecdsa_inversed_secret_coeff_from_shares(
    t: usize,
    id_numbers: &[Secret],
    shares: &[Secret],
) -> Result<Secret, Error> {
    debug_assert_eq!(shares.len(), 2 * t + 1);
    debug_assert_eq!(shares.len(), id_numbers.len());

    let u_shares = (0..2 * t + 1)
        .map(|i| {
            compute_shadow_mul(
                &shares[i],
                &id_numbers[i],
                id_numbers
                    .iter()
                    .enumerate()
                    .filter(|&(j, _)| i != j)
                    .map(|(_, id)| id)
                    .take(2 * t),
            )
        })
        .collect::<Result<Vec<_>, _>>()?;

    // compute u
    let u = compute_secret_sum(u_shares.iter())?;

    // compute inv(u)
    let mut u_inv = u;
    u_inv.inv()?;
    Ok(u_inv)
}

#[cfg(test)]
pub mod tests {
    use super::*;
    use ethkey::{recover, verify_public, KeyPair};
    use std::iter::once;

    #[derive(Clone)]
    struct KeyGenerationArtifacts {
        id_numbers: Vec<Secret>,
        polynoms1: Vec<Vec<Secret>>,
        secrets1: Vec<Vec<Secret>>,
        public_shares: Vec<Public>,
        secret_shares: Vec<Secret>,
        joint_public: Public,
    }

    struct ZeroGenerationArtifacts {
        polynoms1: Vec<Vec<Secret>>,
        secret_shares: Vec<Secret>,
    }

    fn prepare_polynoms1(t: usize, n: usize, secret_required: Option<Secret>) -> Vec<Vec<Secret>> {
        let mut polynoms1: Vec<_> = (0..n)
            .map(|_| generate_random_polynom(t).unwrap())
            .collect();
        // if we need specific secret to be shared, update polynoms so that sum of their free terms = required secret
        if let Some(mut secret_required) = secret_required {
            for polynom1 in polynoms1.iter_mut().take(n - 1) {
                let secret_coeff1 = generate_random_scalar().unwrap();
                secret_required.sub(&secret_coeff1).unwrap();
                polynom1[0] = secret_coeff1;
            }

            polynoms1[n - 1][0] = secret_required;
        }
        polynoms1
    }

    fn run_key_generation(
        t: usize,
        n: usize,
        id_numbers: Option<Vec<Secret>>,
        secret_required: Option<Secret>,
    ) -> KeyGenerationArtifacts {
        // === PART1: DKG ===

        // data, gathered during initialization
        let derived_point = Random.generate().unwrap().public().clone();
        let id_numbers: Vec<_> = match id_numbers {
            Some(id_numbers) => id_numbers,
            None => (0..n).map(|_| generate_random_scalar().unwrap()).collect(),
        };

        // data, generated during keys dissemination
        let polynoms1 = prepare_polynoms1(t, n, secret_required);
        let secrets1: Vec<_> = (0..n)
            .map(|i| {
                (0..n)
                    .map(|j| compute_polynom(&polynoms1[i], &id_numbers[j]).unwrap())
                    .collect::<Vec<_>>()
            })
            .collect();

        // following data is used only on verification step
        let polynoms2: Vec<_> = (0..n)
            .map(|_| generate_random_polynom(t).unwrap())
            .collect();
        let secrets2: Vec<_> = (0..n)
            .map(|i| {
                (0..n)
                    .map(|j| compute_polynom(&polynoms2[i], &id_numbers[j]).unwrap())
                    .collect::<Vec<_>>()
            })
            .collect();
        let publics: Vec<_> = (0..n)
            .map(|i| {
                public_values_generation(t, &derived_point, &polynoms1[i], &polynoms2[i]).unwrap()
            })
            .collect();

        // keys verification
        (0..n).for_each(|i| {
            (0..n).filter(|&j| i != j).for_each(|j| {
                assert!(keys_verification(
                    t,
                    &derived_point,
                    &id_numbers[i],
                    &secrets1[j][i],
                    &secrets2[j][i],
                    &publics[j]
                )
                .unwrap());
            })
        });

        // data, generated during keys generation
        let public_shares: Vec<_> = (0..n)
            .map(|i| compute_public_share(&polynoms1[i][0]).unwrap())
            .collect();
        let secret_shares: Vec<_> = (0..n)
            .map(|i| compute_secret_share(secrets1.iter().map(|s| &s[i])).unwrap())
            .collect();

        // joint public key, as a result of DKG
        let joint_public = compute_joint_public(public_shares.iter()).unwrap();

        KeyGenerationArtifacts {
            id_numbers: id_numbers,
            polynoms1: polynoms1,
            secrets1: secrets1,
            public_shares: public_shares,
            secret_shares: secret_shares,
            joint_public: joint_public,
        }
    }

    fn run_zero_key_generation(
        t: usize,
        n: usize,
        id_numbers: &[Secret],
    ) -> ZeroGenerationArtifacts {
        // data, generated during keys dissemination
        let polynoms1 = prepare_polynoms1(t, n, Some(zero_scalar()));
        let secrets1: Vec<_> = (0..n)
            .map(|i| {
                (0..n)
                    .map(|j| compute_polynom(&polynoms1[i], &id_numbers[j]).unwrap())
                    .collect::<Vec<_>>()
            })
            .collect();

        // data, generated during keys generation
        let secret_shares: Vec<_> = (0..n)
            .map(|i| compute_secret_share(secrets1.iter().map(|s| &s[i])).unwrap())
            .collect();

        ZeroGenerationArtifacts {
            polynoms1: polynoms1,
            secret_shares: secret_shares,
        }
    }

    fn run_key_share_refreshing(
        old_t: usize,
        new_t: usize,
        new_n: usize,
        old_artifacts: &KeyGenerationArtifacts,
    ) -> KeyGenerationArtifacts {
        // === share refreshing protocol from
        // === based on "Verifiable Secret Redistribution for Threshold Sharing Schemes"
        // === http://www.cs.cmu.edu/~wing/publications/CMU-CS-02-114.pdf

        // generate new id_numbers for new nodes
        let new_nodes = new_n.saturating_sub(old_artifacts.id_numbers.len());
        let id_numbers: Vec<_> = old_artifacts
            .id_numbers
            .iter()
            .take(new_n)
            .cloned()
            .chain((0..new_nodes).map(|_| generate_random_scalar().unwrap()))
            .collect();

        // on every authorized node: generate random polynomial ai(j) = si + ... + ai[new_t - 1] * j^(new_t - 1)
        let mut subshare_polynoms = Vec::new();
        for i in 0..old_t + 1 {
            let mut subshare_polynom = generate_random_polynom(new_t).unwrap();
            subshare_polynom[0] = old_artifacts.secret_shares[i].clone();
            subshare_polynoms.push(subshare_polynom);
        }

        // on every authorized node: calculate subshare for every new node
        let mut subshares = Vec::new();
        for j in 0..new_n {
            let mut subshares_to_j = Vec::new();
            for i in 0..old_t + 1 {
                let subshare_from_i_to_j =
                    compute_polynom(&subshare_polynoms[i], &id_numbers[j]).unwrap();
                subshares_to_j.push(subshare_from_i_to_j);
            }
            subshares.push(subshares_to_j);
        }

        // on every new node: generate new share using Lagrange interpolation
        // on every node: generate new share using Lagrange interpolation
        let mut new_secret_shares = Vec::new();
        for j in 0..new_n {
            let mut subshares_to_j = Vec::new();
            for i in 0..old_t + 1 {
                let subshare_from_i = &subshares[j][i];
                let id_number_i = &id_numbers[i];
                let other_id_numbers = (0usize..old_t + 1)
                    .filter(|j| *j != i)
                    .map(|j| &id_numbers[j]);
                let mut subshare_from_i =
                    compute_shadow_mul(subshare_from_i, id_number_i, other_id_numbers).unwrap();
                if old_t % 2 != 0 {
                    subshare_from_i.neg().unwrap();
                }
                subshares_to_j.push(subshare_from_i);
            }
            new_secret_shares.push(compute_secret_sum(subshares_to_j.iter()).unwrap());
        }

        let mut result = old_artifacts.clone();
        result.id_numbers = id_numbers;
        result.secret_shares = new_secret_shares;
        result
    }

    fn run_multiplication_protocol(
        t: usize,
        secret_shares1: &[Secret],
        secret_shares2: &[Secret],
    ) -> Vec<Secret> {
        let n = secret_shares1.len();
        assert!(t * 2 + 1 <= n);

        // shares of secrets multiplication = multiplication of secrets shares
        let mul_shares: Vec<_> = (0..n)
            .map(|i| {
                let share1 = secret_shares1[i].clone();
                let share2 = secret_shares2[i].clone();
                let mut mul_share = share1;
                mul_share.mul(&share2).unwrap();
                mul_share
            })
            .collect();

        mul_shares
    }

    fn run_reciprocal_protocol(t: usize, artifacts: &KeyGenerationArtifacts) -> Vec<Secret> {
        // === Given a secret x mod r which is shared among n players, it is
        // === required to generate shares of inv(x) mod r with out revealing
        // === any information about x or inv(x).
        // === https://www.researchgate.net/publication/280531698_Robust_Threshold_Elliptic_Curve_Digital_Signature

        // generate shared random secret e for given t
        let n = artifacts.id_numbers.len();
        assert!(t * 2 + 1 <= n);
        let e_artifacts = run_key_generation(t, n, Some(artifacts.id_numbers.clone()), None);

        // generate shares of zero for 2 * t threshold
        let z_artifacts = run_zero_key_generation(2 * t, n, &artifacts.id_numbers);

        // each player computes && broadcast u[i] = x[i] * e[i] + z[i]
        let ui: Vec<_> = (0..n)
            .map(|i| {
                compute_ecdsa_inversed_secret_coeff_share(
                    &artifacts.secret_shares[i],
                    &e_artifacts.secret_shares[i],
                    &z_artifacts.secret_shares[i],
                )
                .unwrap()
            })
            .collect();

        // players can interpolate the polynomial of degree 2t and compute u && inv(u):
        let u_inv = compute_ecdsa_inversed_secret_coeff_from_shares(
            t,
            &artifacts
                .id_numbers
                .iter()
                .take(2 * t + 1)
                .cloned()
                .collect::<Vec<_>>(),
            &ui.iter().take(2 * t + 1).cloned().collect::<Vec<_>>(),
        )
        .unwrap();

        // each player Pi computes his share of inv(x) as e[i] * inv(u)
        let x_inv_shares: Vec<_> = (0..n)
            .map(|i| {
                let mut x_inv_share = e_artifacts.secret_shares[i].clone();
                x_inv_share.mul(&u_inv).unwrap();
                x_inv_share
            })
            .collect();

        x_inv_shares
    }

    pub fn do_encryption_and_decryption(
        t: usize,
        joint_public: &Public,
        id_numbers: &[Secret],
        secret_shares: &[Secret],
        joint_secret: Option<&Secret>,
        document_secret_plain: Public,
    ) -> (Public, Public) {
        // === PART2: encryption using joint public key ===

        // the next line is executed on KeyServer-client
        let encrypted_secret = encrypt_secret(&document_secret_plain, &joint_public).unwrap();

        // === PART3: decryption ===

        // next line is executed on KeyServer client
        let access_key = generate_random_scalar().unwrap();

        // use t + 1 nodes to compute joint shadow point
        let nodes_shadows: Vec<_> = (0..t + 1)
            .map(|i| {
                compute_node_shadow(
                    &secret_shares[i],
                    &id_numbers[i],
                    id_numbers
                        .iter()
                        .enumerate()
                        .filter(|&(j, _)| j != i)
                        .take(t)
                        .map(|(_, id_number)| id_number),
                )
                .unwrap()
            })
            .collect();

        let nodes_shadow_points: Vec<_> = nodes_shadows
            .iter()
            .map(|s| {
                compute_node_shadow_point(&access_key, &encrypted_secret.common_point, s, None)
                    .unwrap()
            })
            .map(|sp| sp.0)
            .collect();

        assert_eq!(nodes_shadows.len(), t + 1);
        assert_eq!(nodes_shadow_points.len(), t + 1);

        let joint_shadow_point = compute_joint_shadow_point(nodes_shadow_points.iter()).unwrap();
        let joint_shadow_point_test = compute_joint_shadow_point_test(
            &access_key,
            &encrypted_secret.common_point,
            nodes_shadows.iter(),
        )
        .unwrap();
        assert_eq!(joint_shadow_point, joint_shadow_point_test);

        // decrypt encrypted secret using joint shadow point
        let document_secret_decrypted = decrypt_with_joint_shadow(
            t,
            &access_key,
            &encrypted_secret.encrypted_point,
            &joint_shadow_point,
        )
        .unwrap();

        // decrypt encrypted secret using joint secret [just for test]
        let document_secret_decrypted_test = match joint_secret {
            Some(joint_secret) => decrypt_with_joint_secret(
                &encrypted_secret.encrypted_point,
                &encrypted_secret.common_point,
                joint_secret,
            )
            .unwrap(),
            None => document_secret_decrypted.clone(),
        };

        (document_secret_decrypted, document_secret_decrypted_test)
    }

    #[test]
    fn full_encryption_math_session() {
        let test_cases = [
            (0, 2),
            (1, 2),
            (1, 3),
            (2, 3),
            (1, 4),
            (2, 4),
            (3, 4),
            (1, 5),
            (2, 5),
            (3, 5),
            (4, 5),
            (1, 10),
            (2, 10),
            (3, 10),
            (4, 10),
            (5, 10),
            (6, 10),
            (7, 10),
            (8, 10),
            (9, 10),
        ];
        for &(t, n) in &test_cases {
            let artifacts = run_key_generation(t, n, None, None);

            // compute joint private key [just for test]
            let joint_secret =
                compute_joint_secret(artifacts.polynoms1.iter().map(|p| &p[0])).unwrap();
            let joint_key_pair = KeyPair::from_secret(joint_secret.clone()).unwrap();
            assert_eq!(&artifacts.joint_public, joint_key_pair.public());

            // check secret shares computation [just for test]
            let secret_shares_polynom: Vec<_> = (0..t + 1)
                .map(|k| compute_secret_share(artifacts.polynoms1.iter().map(|p| &p[k])).unwrap())
                .collect();
            let secret_shares_calculated_from_polynom: Vec<_> = artifacts
                .id_numbers
                .iter()
                .map(|id_number| compute_polynom(&*secret_shares_polynom, id_number).unwrap())
                .collect();
            assert_eq!(
                artifacts.secret_shares,
                secret_shares_calculated_from_polynom
            );

            // now encrypt and decrypt data
            let document_secret_plain = generate_random_point().unwrap();
            let (document_secret_decrypted, document_secret_decrypted_test) =
                do_encryption_and_decryption(
                    t,
                    &artifacts.joint_public,
                    &artifacts.id_numbers,
                    &artifacts.secret_shares,
                    Some(&joint_secret),
                    document_secret_plain.clone(),
                );

            assert_eq!(document_secret_plain, document_secret_decrypted_test);
            assert_eq!(document_secret_plain, document_secret_decrypted);
        }
    }

    #[test]
    fn local_signature_works() {
        let key_pair = Random.generate().unwrap();
        let message_hash = "0000000000000000000000000000000000000000000000000000000000000042"
            .parse()
            .unwrap();
        let nonce = generate_random_scalar().unwrap();
        let signature =
            local_compute_schnorr_signature(&nonce, key_pair.secret(), &message_hash).unwrap();
        assert_eq!(
            verify_schnorr_signature(key_pair.public(), &signature, &message_hash),
            Ok(true)
        );
    }

    #[test]
    fn full_schnorr_signature_math_session() {
        let test_cases = [
            (0, 1),
            (0, 2),
            (1, 2),
            (1, 3),
            (2, 3),
            (1, 4),
            (2, 4),
            (3, 4),
            (1, 5),
            (2, 5),
            (3, 5),
            (4, 5),
            (1, 10),
            (2, 10),
            (3, 10),
            (4, 10),
            (5, 10),
            (6, 10),
            (7, 10),
            (8, 10),
            (9, 10),
        ];
        for &(t, n) in &test_cases {
            // hash of the message to be signed
            let message_hash: Secret =
                "0000000000000000000000000000000000000000000000000000000000000042"
                    .parse()
                    .unwrap();

            // === MiDS-S algorithm ===
            // setup: all nodes share master secret key && every node knows master public key
            let artifacts = run_key_generation(t, n, None, None);

            // in this gap (not related to math):
            // master node should ask every other node if it is able to do a signing
            // if there are < than t+1 nodes, able to sign => error
            // select t+1 nodes for signing session
            // all steps below are for this subset of nodes
            let n = t + 1;

            // step 1: run DKG to generate one-time secret key (nonce)
            let id_numbers = artifacts.id_numbers.iter().cloned().take(n).collect();
            let one_time_artifacts = run_key_generation(t, n, Some(id_numbers), None);

            // step 2: message hash && x coordinate of one-time public value are combined
            let combined_hash =
                combine_message_hash_with_public(&message_hash, &one_time_artifacts.joint_public)
                    .unwrap();

            // step 3: compute signature shares
            let partial_signatures: Vec<_> = (0..n)
                .map(|i| {
                    compute_schnorr_signature_share(
                        t,
                        &combined_hash,
                        &one_time_artifacts.polynoms1[i][0],
                        &artifacts.secret_shares[i],
                        &artifacts.id_numbers[i],
                        artifacts
                            .id_numbers
                            .iter()
                            .enumerate()
                            .filter(|&(j, _)| i != j)
                            .map(|(_, n)| n)
                            .take(t),
                    )
                    .unwrap()
                })
                .collect();

            // step 4: receive and verify signatures shares from other nodes
            let received_signatures: Vec<Vec<_>> = (0..n)
                .map(|i| {
                    (0..n)
                        .filter(|j| i != *j)
                        .map(|j| {
                            let signature_share = partial_signatures[j].clone();
                            assert!(_check_schnorr_signature_share(
                                &combined_hash,
                                &signature_share,
                                &artifacts.public_shares[j],
                                &one_time_artifacts.public_shares[j],
                                artifacts.id_numbers.iter().take(t)
                            )
                            .unwrap_or(false));
                            signature_share
                        })
                        .collect()
                })
                .collect();

            // step 5: compute signature
            let signatures: Vec<_> = (0..n)
                .map(|i| {
                    (
                        combined_hash.clone(),
                        compute_schnorr_signature(
                            received_signatures[i]
                                .iter()
                                .chain(once(&partial_signatures[i])),
                        )
                        .unwrap(),
                    )
                })
                .collect();

            // === verify signature ===
            let master_secret =
                compute_joint_secret(artifacts.polynoms1.iter().map(|p| &p[0])).unwrap();
            let nonce =
                compute_joint_secret(one_time_artifacts.polynoms1.iter().map(|p| &p[0])).unwrap();
            let local_signature =
                local_compute_schnorr_signature(&nonce, &master_secret, &message_hash).unwrap();
            for signature in &signatures {
                assert_eq!(signature, &local_signature);
                assert_eq!(
                    verify_schnorr_signature(&artifacts.joint_public, signature, &message_hash),
                    Ok(true)
                );
            }
        }
    }

    #[test]
    fn full_ecdsa_signature_math_session() {
        let test_cases = [(2, 5), (2, 6), (3, 11), (4, 11)];
        for &(t, n) in &test_cases {
            // values that can be hardcoded
            let joint_secret: Secret = Random.generate().unwrap().secret().clone();
            let joint_nonce: Secret = Random.generate().unwrap().secret().clone();
            let message_hash: H256 = H256::random();

            // convert message hash to EC scalar
            let message_hash_scalar = to_scalar(message_hash.clone()).unwrap();

            // generate secret key shares
            let artifacts = run_key_generation(t, n, None, Some(joint_secret));

            // generate nonce shares
            let nonce_artifacts =
                run_key_generation(t, n, Some(artifacts.id_numbers.clone()), Some(joint_nonce));

            // compute nonce public
            // x coordinate (mapped to EC field) of this public is the r-portion of signature
            let nonce_public_shares: Vec<_> = (0..n)
                .map(|i| compute_public_share(&nonce_artifacts.polynoms1[i][0]).unwrap())
                .collect();
            let nonce_public = compute_joint_public(nonce_public_shares.iter()).unwrap();
            let signature_r = compute_ecdsa_r(&nonce_public).unwrap();

            // compute shares of inv(nonce) so that both nonce && inv(nonce) are still unknown to all nodes
            let nonce_inv_shares = run_reciprocal_protocol(t, &nonce_artifacts);

            // compute multiplication of secret-shares * inv-nonce-shares
            let mul_shares =
                run_multiplication_protocol(t, &artifacts.secret_shares, &nonce_inv_shares);

            // compute shares for s portion of signature: nonce_inv * (message_hash + secret * signature_r)
            // every node broadcasts this share
            let double_t = 2 * t;
            let signature_s_shares: Vec<_> = (0..double_t + 1)
                .map(|i| {
                    compute_ecdsa_s_share(
                        &nonce_inv_shares[i],
                        &mul_shares[i],
                        &signature_r,
                        &message_hash_scalar,
                    )
                    .unwrap()
                })
                .collect();

            // compute signature_s from received shares
            let signature_s = compute_ecdsa_s(
                t,
                &signature_s_shares,
                &artifacts
                    .id_numbers
                    .iter()
                    .take(double_t + 1)
                    .cloned()
                    .collect::<Vec<_>>(),
            )
            .unwrap();

            // check signature
            let signature_actual =
                serialize_ecdsa_signature(&nonce_public, signature_r, signature_s);
            let joint_secret =
                compute_joint_secret(artifacts.polynoms1.iter().map(|p| &p[0])).unwrap();
            let joint_secret_pair = KeyPair::from_secret(joint_secret).unwrap();
            assert_eq!(
                recover(&signature_actual, &message_hash).unwrap(),
                *joint_secret_pair.public()
            );
            assert!(
                verify_public(joint_secret_pair.public(), &signature_actual, &message_hash)
                    .unwrap()
            );
        }
    }

    #[test]
    fn full_generation_math_session_with_refreshing_shares() {
        let test_cases = vec![(1, 4), (6, 10)];
        for (t, n) in test_cases {
            // generate key using t-of-n session
            let artifacts1 = run_key_generation(t, n, None, None);
            let joint_secret1 =
                compute_joint_secret(artifacts1.polynoms1.iter().map(|p1| &p1[0])).unwrap();

            // let's say we want to refresh existing secret shares
            // by doing this every T seconds, and assuming that in each T-second period adversary KS is not able to collect t+1 secret shares
            // we can be sure that the scheme is secure
            let artifacts2 = run_key_share_refreshing(t, t, n, &artifacts1);
            let joint_secret2 = compute_joint_secret_from_shares(
                t,
                &artifacts2
                    .secret_shares
                    .iter()
                    .take(t + 1)
                    .collect::<Vec<_>>(),
                &artifacts2.id_numbers.iter().take(t + 1).collect::<Vec<_>>(),
            )
            .unwrap();
            assert_eq!(joint_secret1, joint_secret2);

            // refresh again
            let artifacts3 = run_key_share_refreshing(t, t, n, &artifacts2);
            let joint_secret3 = compute_joint_secret_from_shares(
                t,
                &artifacts3
                    .secret_shares
                    .iter()
                    .take(t + 1)
                    .collect::<Vec<_>>(),
                &artifacts3.id_numbers.iter().take(t + 1).collect::<Vec<_>>(),
            )
            .unwrap();
            assert_eq!(joint_secret1, joint_secret3);
        }
    }

    #[test]
    fn full_generation_math_session_with_adding_new_nodes() {
        let test_cases = vec![(1, 3), (1, 4), (6, 10)];
        for (t, n) in test_cases {
            // generate key using t-of-n session
            let artifacts1 = run_key_generation(t, n, None, None);
            let joint_secret1 =
                compute_joint_secret(artifacts1.polynoms1.iter().map(|p1| &p1[0])).unwrap();

            // let's say we want to include additional couple of servers to the set
            // so that scheme becames t-of-n+2
            let artifacts2 = run_key_share_refreshing(t, t, n + 2, &artifacts1);
            let joint_secret2 = compute_joint_secret_from_shares(
                t,
                &artifacts2
                    .secret_shares
                    .iter()
                    .take(t + 1)
                    .collect::<Vec<_>>(),
                &artifacts2.id_numbers.iter().take(t + 1).collect::<Vec<_>>(),
            )
            .unwrap();
            assert_eq!(joint_secret1, joint_secret2);

            // include another server (t-of-n+3)
            let artifacts3 = run_key_share_refreshing(t, t, n + 3, &artifacts2);
            let joint_secret3 = compute_joint_secret_from_shares(
                t,
                &artifacts3
                    .secret_shares
                    .iter()
                    .take(t + 1)
                    .collect::<Vec<_>>(),
                &artifacts3.id_numbers.iter().take(t + 1).collect::<Vec<_>>(),
            )
            .unwrap();
            assert_eq!(joint_secret1, joint_secret3);
        }
    }

    #[test]
    fn full_generation_math_session_with_decreasing_threshold() {
        let (t, n) = (3, 5);

        // generate key using t-of-n session
        let artifacts1 = run_key_generation(t, n, None, None);

        let joint_secret1 =
            compute_joint_secret(artifacts1.polynoms1.iter().map(|p1| &p1[0])).unwrap();

        // let's say we want to decrease threshold so that it becames (t-1)-of-n
        let new_t = t - 1;
        let artifacts2 = run_key_share_refreshing(t, new_t, n, &artifacts1);
        let joint_secret2 = compute_joint_secret_from_shares(
            new_t,
            &artifacts2
                .secret_shares
                .iter()
                .take(new_t + 1)
                .collect::<Vec<_>>(),
            &artifacts2
                .id_numbers
                .iter()
                .take(new_t + 1)
                .collect::<Vec<_>>(),
        )
        .unwrap();
        assert_eq!(joint_secret1, joint_secret2);

        // let's say we want to decrease threshold once again so that it becames (t-2)-of-n
        let t = t - 1;
        let new_t = t - 2;
        let artifacts3 = run_key_share_refreshing(t, new_t, n, &artifacts2);
        let joint_secret3 = compute_joint_secret_from_shares(
            new_t,
            &artifacts3
                .secret_shares
                .iter()
                .take(new_t + 1)
                .collect::<Vec<_>>(),
            &artifacts3
                .id_numbers
                .iter()
                .take(new_t + 1)
                .collect::<Vec<_>>(),
        )
        .unwrap();
        assert_eq!(joint_secret1, joint_secret3);
    }

    #[test]
    fn full_zero_secret_generation_math_session() {
        let test_cases = vec![(1, 4), (2, 4)];
        for (t, n) in test_cases {
            // run joint zero generation session
            let id_numbers: Vec<_> = (0..n).map(|_| generate_random_scalar().unwrap()).collect();
            let artifacts = run_zero_key_generation(t, n, &id_numbers);

            // check that zero secret is generated
            // we can't compute secrets sum here, because result will be zero (invalid secret, unsupported by SECP256k1)
            // so just use complement trick: x + (-x) = 0
            // TODO [Refac]: switch to SECP256K1-free scalar EC arithmetic
            let partial_joint_secret =
                compute_secret_sum(artifacts.polynoms1.iter().take(n - 1).map(|p| &p[0])).unwrap();
            let mut partial_joint_secret_complement = artifacts.polynoms1[n - 1][0].clone();
            partial_joint_secret_complement.neg().unwrap();
            assert_eq!(partial_joint_secret, partial_joint_secret_complement);
        }
    }

    #[test]
    fn full_generation_with_multiplication() {
        let test_cases = vec![(1, 3), (2, 5), (2, 7), (3, 8)];
        for (t, n) in test_cases {
            // generate two shared secrets
            let artifacts1 = run_key_generation(t, n, None, None);
            let artifacts2 = run_key_generation(t, n, Some(artifacts1.id_numbers.clone()), None);

            // multiplicate original secrets
            let joint_secret1 =
                compute_joint_secret(artifacts1.polynoms1.iter().map(|p| &p[0])).unwrap();
            let joint_secret2 =
                compute_joint_secret(artifacts2.polynoms1.iter().map(|p| &p[0])).unwrap();
            let mut expected_joint_secret_mul = joint_secret1;
            expected_joint_secret_mul.mul(&joint_secret2).unwrap();

            // run multiplication protocol
            let joint_secret_mul_shares = run_multiplication_protocol(
                t,
                &artifacts1.secret_shares,
                &artifacts2.secret_shares,
            );

            // calculate actual secrets multiplication
            let double_t = t * 2;
            let actual_joint_secret_mul = compute_joint_secret_from_shares(
                double_t,
                &joint_secret_mul_shares
                    .iter()
                    .take(double_t + 1)
                    .collect::<Vec<_>>(),
                &artifacts1
                    .id_numbers
                    .iter()
                    .take(double_t + 1)
                    .collect::<Vec<_>>(),
            )
            .unwrap();

            assert_eq!(actual_joint_secret_mul, expected_joint_secret_mul);
        }
    }

    #[test]
    fn full_generation_with_reciprocal() {
        let test_cases = vec![(1, 3), (2, 5), (2, 7), (2, 7), (3, 8)];
        for (t, n) in test_cases {
            // generate shared secret
            let artifacts = run_key_generation(t, n, None, None);

            // calculate inversion of original shared secret
            let joint_secret =
                compute_joint_secret(artifacts.polynoms1.iter().map(|p| &p[0])).unwrap();
            let mut expected_joint_secret_inv = joint_secret.clone();
            expected_joint_secret_inv.inv().unwrap();

            // run inversion protocol
            let reciprocal_shares = run_reciprocal_protocol(t, &artifacts);

            // calculate actual secret inversion
            let double_t = t * 2;
            let actual_joint_secret_inv = compute_joint_secret_from_shares(
                double_t,
                &reciprocal_shares
                    .iter()
                    .take(double_t + 1)
                    .collect::<Vec<_>>(),
                &artifacts
                    .id_numbers
                    .iter()
                    .take(double_t + 1)
                    .collect::<Vec<_>>(),
            )
            .unwrap();

            assert_eq!(actual_joint_secret_inv, expected_joint_secret_inv);
        }
    }
}