@Override
  public byte[] decrypt(final byte[] ciphertext, final byte[] associatedData)
      throws GeneralSecurityException {
    try {
      ByteBuffer buffer = ByteBuffer.wrap(ciphertext);
      int encryptedDekSize = buffer.getInt();
      if (encryptedDekSize <= 0 || encryptedDekSize > (ciphertext.length - LENGTH_ENCRYPTED_DEK)) {
        throw new GeneralSecurityException("invalid ciphertext");
      }
      byte[] encryptedDek = new byte[encryptedDekSize];
      buffer.get(encryptedDek, 0, encryptedDekSize);
      byte[] payload = new byte[buffer.remaining()];
      buffer.get(payload, 0, buffer.remaining());
      // Use remote to decrypt encryptedDek.
      byte[] dek = remote.decrypt(encryptedDek, EMPTY_AAD);
      // Use DEK to decrypt payload.
      ProtoKeySerialization serialization =
          ProtoKeySerialization.create(
              typeUrlForParsing,
              ByteString.copyFrom(dek),
              KeyMaterialType.SYMMETRIC,
              OutputPrefixType.RAW,
              /* idRequirement= */ null);
      Key key =
          MutableSerializationRegistry.globalInstance()
              .parseKey(serialization, InsecureSecretKeyAccess.get());

      Aead aead = MutablePrimitiveRegistry.globalInstance().getPrimitive(key, Aead.class);
      return aead.decrypt(payload, associatedData);
    } catch (IndexOutOfBoundsException
             | BufferUnderflowException
             | NegativeArraySizeException e) {
      throw new GeneralSecurityException("invalid ciphertext", e);
    }
  }
Creates a new instance of Tink's KMS Envelope AEAD.

<p>{@code dekParameters} must be any of these Tink AEAD parameters (any other will be
rejected): {@link AesGcmParameters}, {@link ChaCha20Poly1305Parameters}, {@link
XChaCha20Poly1305Parameters}, {@link AesCtrHmacAeadParameters}, {@link AesGcmSivParameters}, or
{@link AesEaxParameters}.
java_src/src/main/java/com/google/crypto/tink/aead/KmsEnvelopeAead.java