@Test
  public void getPrimitiveFromLegacyKmsEnvelopeAeadKeyWithTinkPrefix_works() throws Exception {
    String kekUri = FakeKmsClient.createFakeKeyUri();
    LegacyKmsEnvelopeAeadParameters parameters =
        LegacyKmsEnvelopeAeadParameters.builder()
            .setVariant(LegacyKmsEnvelopeAeadParameters.Variant.TINK)
            .setKekUri(kekUri)
            .setDekParsingStrategy(DekParsingStrategy.ASSUME_AES_EAX)
            .setDekParametersForNewKeys(
                AesEaxParameters.builder()
                    .setIvSizeBytes(16)
                    .setKeySizeBytes(16)
                    .setTagSizeBytes(16)
                    .setVariant(AesEaxParameters.Variant.NO_PREFIX)
                    .build())
            .build();
    LegacyKmsEnvelopeAeadKey key =
        LegacyKmsEnvelopeAeadKey.create(parameters, /* idRequirement= */ 0xbbccddee);
    KeysetHandle keysetHandle =
        KeysetHandle.newBuilder()
            .addEntry(KeysetHandle.importKey(key).withFixedId(0xbbccddee).makePrimary())
            .build();

    Aead aead = keysetHandle.getPrimitive(RegistryConfiguration.get(), Aead.class);
    TestUtil.runBasicAeadTests(aead);

    byte[] plaintext = Random.randBytes(20);
    byte[] associatedData = Random.randBytes(20);
    byte[] ciphertext = aead.encrypt(plaintext, associatedData);
    assertThat(
            isPrefix(
                new byte[] {(byte) 0x01, (byte) 0xbb, (byte) 0xcc, (byte) 0xdd, (byte) 0xee},
                ciphertext))
        .isTrue();

    // Also check that aead is compatible with an Aead created with KmsEnvelopeAead.create(), if
    // the 5 byte prefix is removed.
    Aead keyEncryptionAead = new FakeKmsClient().getAead(kekUri);
    Aead aead2 = KmsEnvelopeAead.create(PredefinedAeadParameters.AES128_EAX, keyEncryptionAead);
    byte[] ciphertextWithoutPrefix = Arrays.copyOfRange(ciphertext, 5, ciphertext.length);
    byte[] decrypted = aead2.decrypt(ciphertextWithoutPrefix, associatedData);
    assertThat(decrypted).isEqualTo(plaintext);
  }
Tests for {@code KmsEnvelopeAead} and {@code KmsEnvelopeAeadKeyManager}.
java_src/src/test/java/com/google/crypto/tink/aead/KmsEnvelopeAeadKeyManagerTest.java