private byte[] splitConcatenatedKey(byte[] concatenatedKek) {
        int keyLength = concatenatedKek[0];
        int algoLength = concatenatedKek.length - keyLength - 1;

        if (!isValidKeyLength(keyLength)) {
            throw new SecurityException("invalid key length in composite CEK");
        }

        if (algoLength <= 0) {
            throw new SecurityException("invalid algorithm length in composite CEK");
        }

        byte[] cek = new byte[keyLength];
        byte[] algo = new byte[algoLength];
        System.arraycopy(concatenatedKek, 1, cek, 0, keyLength);
        System.arraycopy(concatenatedKek, 1 + keyLength, algo, 0, algoLength);

        if (!Arrays.equals(algo, this.encodedCekAlgorithm)) {
            throw new SecurityException("The content encryption algorithm used at encryption time does not match the " +
                                            "algorithm stored for decryption time. The object may be altered or " +
                                            "corrupted.");
        }

        return cek;
    }
The cipher algorithm name is the string used to correctly configure the cipher provider.
Do not confuse with {@link InternalKeyWrapAlgorithm#algorithmName()} which is an agreed-upon term
within Amazon Web Services.
aws-java-sdk-s3/src/main/java/com/amazonaws/services/s3/internal/crypto/keywrap/RsaOaepKeyWrapper.java