@Test
  public void multipleAeadsWithSameKekAndDifferentDekTemplateOfSameKeyType_canDecryptEachOther()
      throws Exception {
    String kekUri = FakeKmsClient.createFakeKeyUri();

    KeyTemplate dek1Template = AesCtrHmacAeadKeyManager.aes128CtrHmacSha256Template();
    KeysetHandle handle1 =
        KeysetHandle.generateNew(KmsEnvelopeAeadKeyManager.createKeyTemplate(kekUri, dek1Template));
    Aead aead1 = handle1.getPrimitive(Aead.class);

    KeyTemplate dek2Template = AesCtrHmacAeadKeyManager.aes256CtrHmacSha256Template();
    KeysetHandle handle2 =
        KeysetHandle.generateNew(KmsEnvelopeAeadKeyManager.createKeyTemplate(kekUri, dek2Template));
    Aead aead2 = handle2.getPrimitive(Aead.class);

    byte[] plaintext = Random.randBytes(20);
    byte[] associatedData = Random.randBytes(20);

    byte[] ciphertext = aead1.encrypt(plaintext, associatedData);

    // This works because ciphertext contains an encrypted AesCtrHmacAeadKey, which aead2 correctly
    // decrypts and parses. The resulting key can then decrypt the ciphertext.
    assertThat(aead2.decrypt(ciphertext, associatedData)).isEqualTo(plaintext);
  }
Tests for {@code KmsEnvelopeAead} and {@code KmsEnvelopeAeadKeyManager}.
java_src/src/test/java/com/google/crypto/tink/aead/KmsEnvelopeAeadKeyManagerTest.java