public static LegacyKmsAeadKey create(
      LegacyKmsAeadParameters parameters, @Nullable Integer idRequirement)
      throws GeneralSecurityException {
    Bytes outputPrefix;
    if (parameters.variant() == LegacyKmsAeadParameters.Variant.TINK) {
      if (idRequirement == null) {
        throw new GeneralSecurityException(
            "For given Variant TINK the value of idRequirement must be non-null");
      }
      outputPrefix =
          Bytes.copyFrom(ByteBuffer.allocate(5).put((byte) 1).putInt(idRequirement).array());
    } else if (parameters.variant() == LegacyKmsAeadParameters.Variant.NO_PREFIX) {
      if (idRequirement != null) {
        throw new GeneralSecurityException(
            "For given Variant NO_PREFIX the value of idRequirement must be null");
      }
      outputPrefix = Bytes.copyFrom(new byte[] {});
    } else {
      throw new GeneralSecurityException("Unknown Variant: " + parameters.variant());
    }
    return new LegacyKmsAeadKey(parameters, outputPrefix, idRequirement);
  }
Describes an Aead backed by a KMS.

<p>The KMS is specified by {@code getParameters().getKeyUri()}. When creating an Aead from this
object, Tink looks an {@link com.google.crypto.tink.KmsClient} in the global table of {@link
com.google.crypto.tink.KmsClients}. This means that the key is inappropriate in cases where there
are multiple KMS backends or multiple credentials in a binary. Because of this, we recommend to
create the {@link Aead} directly from the KmsClient you need.
java_src/src/main/java/com/google/crypto/tink/aead/LegacyKmsAeadKey.java