@Test
  public void decryptCiphertextEncryptedInBigQueryUsingAWrappedKeyset() throws Exception {
    String keyUri =
        "gcp-kms://projects/tink-test-infrastructure/locations/us/keyRings/"
            + "big-query-test-key/cryptoKeys/aead-key";

    // This wrapped keyset was generated in BigQuery using this command:
    // DECLARE kms_key_uri STRING;
    // SET kms_key_uri =
    // 'gcp-kms://projects/tink-test-infrastructure/locations/us/keyRings/big-query-test-key/cryptoKeys/aead-key';
    // SELECT KEYS.NEW_WRAPPED_KEYSET(kms_key_uri, 'AEAD_AES_GCM_256')
    byte[] wrappedKeyset =
        Base64.decode(
            "CiQAv82D2I7RT2gQRd/01m+Md8WAmOyehVog50vs5uPq2B+R36YSlQEAba+J9rC0gfmX9FSs8P"
                + "sWIpCVbIvPiflsaHRxq5GQjknVgYuJLIMDXlGhQBa3NrfJSmj1T/KDHQ3EzCcPAXtOAbAExZr/"
                + "7jsgiCzo/YQINyPb2rGkW4ofo/BVyvhZ/Pk40iuPHv8Q/PXVrNsq3Y2vkkpsyb3QUhJZseURGj"
                + "jeQnZde6i3EmvDejXhOZJ3XdQUjwgorA==");

    // This ciphertext was generated in BigQuery using this command:
    // DECLARE kms_key_uri STRING;
    // DECLARE wrapped_key BYTES;
    // SET kms_key_uri =
    // 'gcp-kms://projects/tink-test-infrastructure/locations/us/keyRings/big-query-test-key/cryptoKeys/aead-key';
    // SET wrapped_key =
    // FROM_BASE64('CiQAv82D2I7RT2gQRd/01m+Md8WAmOyehVog50vs5uPq2B+R36YSlQEAba+J9rC0gfmX9FSs8PsWIpCVbIvPiflsaHRxq5GQjknVgYuJLIMDXlGhQBa3NrfJSmj1T/KDHQ3EzCcPAXtOAbAExZr/7jsgiCzo/YQINyPb2rGkW4ofo/BVyvhZ/Pk40iuPHv8Q/PXVrNsq3Y2vkkpsyb3QUhJZseURGjjeQnZde6i3EmvDejXhOZJ3XdQUjwgorA==');
    // SELECT AEAD.ENCRYPT(KEYS.KEYSET_CHAIN(kms_key_uri, wrapped_key), 'elephant', 'animal')
    //     AS encrypted_animal;
    byte[] ciphertext = Base64.decode("AcpCNBevmQnr9momhlKKEyKDOCj5bMfizqC22N/hLZd58LFpC+r99C0=");

    KeysetHandle kmsKeysetHandle =
        KeysetHandle.generateNew(KmsAeadKeyManager.createKeyTemplate(keyUri));
    Aead kmsAead = kmsKeysetHandle.getPrimitive(Aead.class);

    byte[] unwrappedKeyset =
        kmsAead.decrypt(wrappedKeyset, /* associatedData= */ "".getBytes(UTF_8));
    KeysetHandle handle =
        TinkProtoKeysetFormat.parseKeyset(unwrappedKeyset, InsecureSecretKeyAccess.get());
    Aead aead = handle.getPrimitive(Aead.class);
    byte[] decrypted = aead.decrypt(ciphertext, /* associatedData= */ "animal".getBytes(UTF_8));
    assertThat(decrypted).isEqualTo("elephant".getBytes(UTF_8));

    // CleartextKeysetHandle and BinaryKeysetReader instead of TinkProtoKeysetFormat also works
    KeysetHandle handle2 =
        CleartextKeysetHandle.read(BinaryKeysetReader.withBytes(unwrappedKeyset));
    Aead aead2 = handle2.getPrimitive(Aead.class);
    byte[] decrypted2 = aead2.decrypt(ciphertext, /* associatedData= */ "animal".getBytes(UTF_8));
    assertThat(decrypted2).isEqualTo("elephant".getBytes(UTF_8));

    // BigQuery's wrappedKeyset is not compatible with TinkProtoKeysetFormat.parseEncryptedKeyset
    assertThrows(
        GeneralSecurityException.class,
        () ->
            TinkProtoKeysetFormat.parseEncryptedKeyset(wrappedKeyset, kmsAead, "".getBytes(UTF_8)));
  }
Integration tests for Tink's GcpKmsClient with the real GCP Cloud KMS.
java_src/src/test/java/com/google/crypto/tink/integration/gcpkms/GcpKmsIntegrationTest.java