@Test
  public void createTemplateAndDeriveAesGcmKeyset_success() throws Exception {
    Assume.assumeFalse(TestUtil.isAndroid()); // some android versions don't support AesGcm
    Parameters keyDerivationParameters =
        PrfBasedKeyDerivationParameters.builder()
            .setPrfParameters((PrfParameters) KeyTemplates.get("HKDF_SHA256").toParameters())
            .setDerivedKeyParameters(KeyTemplates.get("AES256_GCM").toParameters())
            .build();

    KeysetHandle handle = KeysetHandle.generateNew(keyDerivationParameters);
    KeysetDeriver deriver = handle.getPrimitive(KeysetDeriver.class);

    KeysetHandle derivedHandle = deriver.deriveKeyset("salt".getBytes(UTF_8));

    // Use derived keyset, which should contain an AES256_GCM key.
    Aead aead = derivedHandle.getPrimitive(Aead.class);
    byte[] plaintext = "plaintext".getBytes(UTF_8);
    byte[] associatedData = "associatedData".getBytes(UTF_8);
    byte[] ciphertext = aead.encrypt(plaintext, associatedData);
    assertThat(aead.decrypt(ciphertext, associatedData)).isEqualTo(plaintext);
  }
Unit tests for the Key Derivation package. Uses only the public API.
java_src/src/test/java/com/google/crypto/tink/keyderivation/KeyDerivationTest.java