@Test
  public void testModifyCiphertext() throws Exception {
    Assume.assumeFalse(TinkFips.useOnlyFips());
    Assume.assumeTrue(InsecureNonceChaCha20Poly1305Jce.isSupported());

    byte[] key = Random.randBytes(KEY_SIZE_IN_BYTES);
    InsecureNonceChaCha20Poly1305Jce cipher = createInstance(key);
    byte[] aad = Random.randBytes(16);
    byte[] message = Random.randBytes(32);
    byte[] nonce = Random.randBytes(NONCE_SIZE_IN_BYTES);
    byte[] ciphertext = cipher.encrypt(nonce, message, aad);

    for (BytesMutation mutation : TestUtil.generateMutations(ciphertext)) {
      assertThrows(
          String.format(
              "Decrypting modified ciphertext should fail : ciphertext = %s, aad = %s,"
                  + " description = %s",
              Hex.encode(mutation.value), Arrays.toString(aad), mutation.description),
          GeneralSecurityException.class,
          () -> {
            byte[] unused = cipher.decrypt(nonce, mutation.value, aad);
          });
    }

    // Modify AAD
    for (int b = 0; b < aad.length; b++) {
      for (int bit = 0; bit < 8; bit++) {
        byte[] modified = Arrays.copyOf(aad, aad.length);
        modified[b] ^= (byte) (1 << bit);
        assertThrows(
            AEADBadTagException.class,
            () -> {
              byte[] unused = cipher.decrypt(nonce, ciphertext, modified);
            });
      }
    }
  }
BC had a bug, where GCM failed for messages of size > 8192
java_src/src/test/java/com/google/crypto/tink/aead/internal/InsecureNonceChaCha20Poly1305JceTest.java