@SuppressWarnings("UnusedException")
  private static AesEaxKey parseKey(
      ProtoKeySerialization serialization, @Nullable SecretKeyAccess access)
      throws GeneralSecurityException {
    if (!serialization.getTypeUrl().equals(TYPE_URL)) {
      throw new IllegalArgumentException(
          "Wrong type URL in call to AesEaxProtoSerialization.parseKey");
    }
    try {
      com.google.crypto.tink.proto.AesEaxKey protoKey =
          com.google.crypto.tink.proto.AesEaxKey.parseFrom(
              serialization.getValue(), ExtensionRegistryLite.getEmptyRegistry());
      if (protoKey.getVersion() != 0) {
        throw new GeneralSecurityException("Only version 0 keys are accepted");
      }
      AesEaxParameters parameters =
          AesEaxParameters.builder()
              .setKeySizeBytes(protoKey.getKeyValue().size())
              .setIvSizeBytes(protoKey.getParams().getIvSize())
              .setTagSizeBytes(16)
              .setVariant(toVariant(serialization.getOutputPrefixType()))
              .build();
      return AesEaxKey.builder()
          .setParameters(parameters)
          .setKeyBytes(
              SecretBytes.copyFrom(
                  protoKey.getKeyValue().toByteArray(), SecretKeyAccess.requireAccess(access)))
          .setIdRequirement(serialization.getIdRequirementOrNull())
          .build();
    } catch (InvalidProtocolBufferException e) {
      throw new GeneralSecurityException("Parsing AesEaxcKey failed");
    }
  }
Subtle implementation currently restricts tag size to 16 bytes.
java_src/src/main/java/com/google/crypto/tink/aead/internal/AesEaxProtoSerialization.java