@Override
    public byte[] encrypt(final byte[] plaintext, final byte[] associatedData)
        throws GeneralSecurityException {
      try {
        com.google.cloud.kms.v1.EncryptRequest encryptRequest =
            com.google.cloud.kms.v1.EncryptRequest.newBuilder()
                .setName(keyName)
                .setPlaintext(ByteString.copyFrom(plaintext))
                .setAdditionalAuthenticatedData(ByteString.copyFrom(associatedData))
                .build();

        com.google.cloud.kms.v1.EncryptResponse encResponse = kmsClient.encrypt(encryptRequest);
        return encResponse.getCiphertext().toByteArray();
      } catch (RuntimeException e) {
        throw new GeneralSecurityException("encryption failed", e);
      }
    }
A GRPC-based client to communicate with Google Cloud KMS.
java_src/src/main/java/com/google/crypto/tink/integration/gcpkms/GcpKmsAead.java