@Override
  public byte[] unwrap(final byte[] data) throws GeneralSecurityException {
    if (data.length < wrappingSize(MIN_WRAP_KEY_SIZE)) {
      throw new GeneralSecurityException("Wrapped key size is too small");
    }
    if (data.length > wrappingSize(MAX_WRAP_KEY_SIZE)) {
      throw new GeneralSecurityException("Wrapped key size is too large");
    }
    if (data.length % 8 != 0) {
      throw new GeneralSecurityException(
          "Wrapped key size must be a multiple of 8 bytes");
    }
    byte[] unwrapped = invertW(data);
    // Check the padding.
    // W has been designed to be a strong pseudorandom permutation.
    // Hence leaking any amount of information about improperly padded keys
    // would not be a vulnerability. This means that here we don't have to go to
    // some extra length to assure that the code is constant time. 
    boolean ok = true;
    for (int i = 0; i < 4; i++) {
      if (PREFIX[i] != unwrapped[i]) {
        ok = false;
      }
    }
    int encodedSize = 0;
    for (int i = 4; i < 8; i++) {
      encodedSize = (encodedSize << 8) + (unwrapped[i] & 0xff);
    }
    if (wrappingSize(encodedSize) != unwrapped.length) {
      ok = false;
    } else {
      for (int j = 8 + encodedSize; j < unwrapped.length; j++) {
        if (unwrapped[j] != 0) {
          ok = false;
        }
      }
    }
    if (ok) {
      return Arrays.copyOfRange(unwrapped, 8, 8 + encodedSize);
    } else {
      throw new BadPaddingException("Invalid padding");
    }
  }
Unwraps a wrapped key.

@throws GeneralSecurityException if {@code data} fails the integrity check.
java_src/src/main/java/com/google/crypto/tink/subtle/Kwp.java