generatedKeyPairsAreUsable

Every pair CommutativeScheme.generateKey hands out both round-trips and hides — the secrecy floor said of the generator rather than of one key.

The distinction is the whole reason the second assertion is here rather than left to encryptHidesThePlaintextAndStripRecoversIt. That property draws one key, so it catches a generator that is degenerate always; a generator degenerate only sometimes — SRA's rejection loop tests gcd(e, p-1) != 1 and nothing else, so e = 1 is inside its output domain — slips past it whenever the healthy key is the one drawn. Round-tripping is no defence either: the identity key round-trips perfectly, which is exactly what makes it hard to see.

What this cannot detect. Two draws. A generator that emits a degenerate key one time in a thousand is invisible here and would stay invisible at any count a TCK can afford; the assertion narrows the window rather than closing it. Raising the count is the wrong lever — it multiplies a heavyweight scheme's key generation for a linear gain against an exponential problem.

Mutation receipt — the measurement of the hole this suite had. Give SraScheme.generateKey the identity exponent e = d = 1 on an instance's second draw and exactly two properties red: the second assertion here, and the "stayed covered" arm of multiLayerDealRecoversPlaintextRegardlessOfStripOrder. Both are new in #2313. Everything that existed before stays green — including the first assertion here (the identity key round-trips perfectly) and distinctKeysProduceDistinctCiphertexts, which compares two keys rather than a key against the plaintext, so one degenerate key beside one healthy key still yields differing ciphertexts.