@Test
  public void encryptAndDecryptWithTinkPrefix_success() throws Exception {
    // Create a new key and import it with output prefix type TINK with a fixed key ID.
    byte[] rawAesKey = Random.randBytes(16);
    int keyId = 0x11223344;
    KeysetHandle handle =
        MyCustomKeyManager.aesGcm128KeyToKeysetHandle(rawAesKey, keyId, OutputPrefixType.TINK);

    Aead aead = handle.getPrimitive(Aead.class);
    byte[] plaintext = "plaintext".getBytes(UTF_8);
    byte[] associatedData = "associatedData".getBytes(UTF_8);
    byte[] ciphertext = aead.encrypt(plaintext, associatedData);
    assertThat(aead.decrypt(ciphertext, associatedData)).isEqualTo(plaintext);

    // Check that ciphertext generated using OutputPrefixType.TINK has a 5 byte prefix:
    // the first byte is always 0x01, and the next 4 bytes are the big-endian encoded key ID.
    byte[] prefix = Arrays.copyOf(ciphertext, 5);
    assertThat(prefix)
        .isEqualTo(new byte[] {(byte) 0x01, (byte) 0x11, (byte) 0x22, (byte) 0x33, (byte) 0x44});

    // Check that AesGcmJce can decrypt using the raw key, if the prefix is removed.
    byte[] ciphertextWithoutPrefix = Arrays.copyOfRange(ciphertext, 5, ciphertext.length);
    Aead jceAead = new AesGcmJce(rawAesKey);
    assertThat(jceAead.decrypt(ciphertextWithoutPrefix, associatedData)).isEqualTo(plaintext);
  }
A custom implementation of {@link com.google.crypto.tink.KeyManager} for AES GCM 128.

<p>It only implements the methods of the KeyManager interface that are needed.
java_src/src/test/java/com/google/crypto/tink/custom/CustomAeadKeyManagerTest.java