@Test
  public void flipMsbOfEncapsulatedKeyInCiphertext_fails() throws GeneralSecurityException {
    HpkeParameters parameters =
        HpkeParameters.builder()
            .setKemId(HpkeParameters.KemId.DHKEM_X25519_HKDF_SHA256)
            .setKdfId(HpkeParameters.KdfId.HKDF_SHA256)
            .setAeadId(HpkeParameters.AeadId.AES_256_GCM)
            .build();
    HpkePublicKey recipientPublicKey = getPublicKey(parameters);
    HpkePrivateKey recipientPrivateKey = getPrivateKey(recipientPublicKey);
    HybridEncrypt hpkeEncrypt = HpkeEncrypt.create(recipientPublicKey);
    HybridDecrypt hpkeDecrypt = HpkeDecrypt.create(recipientPrivateKey);

    byte[] input = Random.randBytes(100);
    byte[] contextInfo = Random.randBytes(100);
    byte[] ciphertext = hpkeEncrypt.encrypt(input, contextInfo);

    expect.that(hpkeDecrypt.decrypt(ciphertext, contextInfo)).isEqualTo(input);

    // The first 32 bytes are the encapsulatedKey. Flip its MSB.
    ciphertext[31] = (byte) (ciphertext[31] ^ 128);
    assertThrows(
        GeneralSecurityException.class, () -> hpkeDecrypt.decrypt(ciphertext, contextInfo));
  }
Unit tests for {@link HpkeEncrypt} and {@link HpkeDecrypt}.
java_src/src/test/java/com/google/crypto/tink/hybrid/internal/HpkeEncryptDecryptTest.java