@Override
  public byte[] encrypt(final byte[] plaintext, final byte[] associatedData)
      throws GeneralSecurityException {
    Key key =
        MutableKeyCreationRegistry.globalInstance()
            .createKey(parametersForNewKeys, /* idRequirement= */ null);

    ProtoKeySerialization serialization =
        MutableSerializationRegistry.globalInstance()
            .serializeKey(key, ProtoKeySerialization.class, InsecureSecretKeyAccess.get());
    byte[] dek = serialization.getValue().toByteArray();
    // Wrap it with remote.
    byte[] encryptedDek = remote.encrypt(dek, EMPTY_AAD);
    // Use DEK to encrypt plaintext.
    Aead aead = MutablePrimitiveRegistry.globalInstance().getPrimitive(key, Aead.class);
    byte[] payload = aead.encrypt(plaintext, associatedData);
    // Build ciphertext protobuf and return result.
    return buildCiphertext(encryptedDek, payload);
  }
Creates a new instance of Tink's KMS Envelope AEAD.

<p>{@code dekParameters} must be any of these Tink AEAD parameters (any other will be
rejected): {@link AesGcmParameters}, {@link ChaCha20Poly1305Parameters}, {@link
XChaCha20Poly1305Parameters}, {@link AesCtrHmacAeadParameters}, {@link AesGcmSivParameters}, or
{@link AesEaxParameters}.
java_src/src/main/java/com/google/crypto/tink/aead/KmsEnvelopeAead.java