private byte[] buildCiphertext(final byte[] encryptedDek, final byte[] payload) {
    return ByteBuffer.allocate(LENGTH_ENCRYPTED_DEK + encryptedDek.length + payload.length)
        .putInt(encryptedDek.length)
        .put(encryptedDek)
        .put(payload)
        .array();
  }
Creates a new instance of Tink's KMS Envelope AEAD.

<p>{@code dekParameters} must be any of these Tink AEAD parameters (any other will be
rejected): {@link AesGcmParameters}, {@link ChaCha20Poly1305Parameters}, {@link
XChaCha20Poly1305Parameters}, {@link AesCtrHmacAeadParameters}, {@link AesGcmSivParameters}, or
{@link AesEaxParameters}.
java_src/src/main/java/com/google/crypto/tink/aead/KmsEnvelopeAead.java