public static Aead create(AesCtrHmacAeadKey key) throws GeneralSecurityException {
    return new EncryptThenAuthenticate(
        new AesCtrJceCipher(
            key.getAesKeyBytes().toByteArray(InsecureSecretKeyAccess.get()),
            key.getParameters().getIvSizeBytes()),
        new PrfMac(
            new PrfHmacJce(
                "HMAC" + key.getParameters().getHashType(),
                new SecretKeySpec(
                    key.getHmacKeyBytes().toByteArray(InsecureSecretKeyAccess.get()), "HMAC")),
            key.getParameters().getTagSizeBytes()),
        key.getParameters().getTagSizeBytes(),
        key.getOutputPrefix().toByteArray());
  }
Create an AES CTR HMAC instance. This instance is *full*, meaning that, if the key is of the
type TINK or CRUNCHY, the ciphertexts created by this instance will be prefixed with
`outputPrefix` containing some important Tink metadata.
java_src/src/main/java/com/google/crypto/tink/subtle/EncryptThenAuthenticate.java