javax.crypto.AEADBadTagException Java Examples

@Test
public void replayMessage() throws GeneralSecurityException {
  String message = "Hello world";
  FrameEncrypt frameEncrypt = createFrameEncrypt(message);
  client.encrypt(frameEncrypt.out, frameEncrypt.plain);
  FrameDecrypt frameDecrypt1 = frameDecryptOfEncrypt(frameEncrypt);
  FrameDecrypt frameDecrypt2 = frameDecryptOfEncrypt(frameEncrypt);

  server.decrypt(frameDecrypt1.out, frameDecrypt1.tag, frameDecrypt1.ciphertext);

  try {
    server.decrypt(frameDecrypt2.out, frameDecrypt2.tag, frameDecrypt2.ciphertext);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().containsMatch(DECRYPTION_FAILURE_MESSAGE_RE);
  }
}
 

@Test
public void replayMessage() throws GeneralSecurityException {
  String message = "Hello world";
  FrameEncrypt frameEncrypt = createFrameEncrypt(message);
  client.encrypt(frameEncrypt.out, frameEncrypt.plain);
  FrameDecrypt frameDecrypt1 = frameDecryptOfEncrypt(frameEncrypt);
  FrameDecrypt frameDecrypt2 = frameDecryptOfEncrypt(frameEncrypt);

  server.decrypt(frameDecrypt1.out, frameDecrypt1.tag, frameDecrypt1.ciphertext);

  try {
    server.decrypt(frameDecrypt2.out, frameDecrypt2.tag, frameDecrypt2.ciphertext);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().contains(DECRYPTION_FAILURE_MESSAGE);
  }
}
 

@Test
public void skipMessage() throws GeneralSecurityException {
  String message = "Hello world";
  FrameEncrypt frameEncrypt1 = createFrameEncrypt(message);
  client.encrypt(frameEncrypt1.out, frameEncrypt1.plain);
  FrameEncrypt frameEncrypt2 = createFrameEncrypt(message);
  client.encrypt(frameEncrypt2.out, frameEncrypt2.plain);
  FrameDecrypt frameDecrypt = frameDecryptOfEncrypt(frameEncrypt2);

  try {
    client.decrypt(frameDecrypt.out, frameDecrypt.tag, frameDecrypt.ciphertext);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().contains(DECRYPTION_FAILURE_MESSAGE);
  }
}
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

static void gcm_oneReadByteCorrupt() throws Exception {

        System.out.println("Running gcm_oneReadByteCorrupt test");

        // Encrypt 100 bytes with AES/GCM/PKCS5Padding
        byte[] ct = encryptedText("GCM", 100);
        // Corrupt the encrypted message
        ct = corruptGCM(ct);
        // Create stream for decryption
        CipherInputStream in = getStream("GCM", ct);

        try {
            in.read();
            System.out.println("  Fail. No exception thrown.");
        } catch (IOException e) {
            Throwable ec = e.getCause();
            if (ec instanceof AEADBadTagException) {
                System.out.println("  Pass.");
            } else {
                System.out.println("  Fail: " + ec.getMessage());
                throw new RuntimeException(ec);
            }
        }
    }
 

@Override
public String decrypt(final EncryptionKey key, final byte[] encryptedValue, final byte[] nonce) throws Exception {
  final DecryptRequest request = DecryptRequest.newBuilder().setCipher(ByteString.copyFrom(encryptedValue)).build();
  final DecryptResponse response;
  try {
    response = blockingStub.decrypt(request);
  } catch (final StatusRuntimeException e) {
    if (e.getStatus().getCode() == Status.Code.INVALID_ARGUMENT) {
      throw new AEADBadTagException(e.getMessage());
    }
    LOGGER.error("Error for request: " + request.getCipher(), e);
    throw e;
  }

  return response.getPlain().toString(CHARSET);
}
 

@Test
public void skipMessage() throws GeneralSecurityException {
  String message = "Hello world";
  FrameEncrypt frameEncrypt1 = createFrameEncrypt(message);
  client.encrypt(frameEncrypt1.out, frameEncrypt1.plain);
  FrameEncrypt frameEncrypt2 = createFrameEncrypt(message);
  client.encrypt(frameEncrypt2.out, frameEncrypt2.plain);
  FrameDecrypt frameDecrypt = frameDecryptOfEncrypt(frameEncrypt2);

  try {
    client.decrypt(frameDecrypt.out, frameDecrypt.tag, frameDecrypt.ciphertext);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().containsMatch(DECRYPTION_FAILURE_MESSAGE_RE);
  }
}
 

/** Test corrupted tag. */
public static void corruptedTagTest(Handshakers handshakers, RegisterRef ref)
    throws GeneralSecurityException {
  performHandshake(DEFAULT_TRANSPORT_BUFFER_SIZE, handshakers);

  TsiFrameProtector sender = handshakers.getClient().createFrameProtector(alloc);
  TsiFrameProtector receiver = handshakers.getServer().createFrameProtector(alloc);

  String message = "hello world";
  ByteBuf plaintextBuffer = Unpooled.wrappedBuffer(message.getBytes(UTF_8));
  final List<ByteBuf> protectOut = new ArrayList<>();
  List<Object> unprotectOut = new ArrayList<>();

  sender.protectFlush(
      Collections.singletonList(plaintextBuffer),
      new Consumer<ByteBuf>() {
        @Override
        public void accept(ByteBuf buf) {
          protectOut.add(buf);
        }
      },
      alloc);
  assertThat(protectOut.size()).isEqualTo(1);

  ByteBuf protect = ref.register(protectOut.get(0));
  int tagIdx = protect.writerIndex() - 1;
  protect.setByte(tagIdx, protect.getByte(tagIdx) + 1);

  try {
    receiver.unprotect(protect, unprotectOut, alloc);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().contains(DECRYPTION_FAILURE_RE);
  }

  sender.destroy();
  receiver.destroy();
}
 

@Test
public void reflection() throws GeneralSecurityException {
  String message = "Hello world";
  FrameEncrypt frameEncrypt = createFrameEncrypt(message);
  client.encrypt(frameEncrypt.out, frameEncrypt.plain);
  FrameDecrypt frameDecrypt = frameDecryptOfEncrypt(frameEncrypt);
  try {
    client.decrypt(frameDecrypt.out, frameDecrypt.tag, frameDecrypt.ciphertext);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().containsMatch(DECRYPTION_FAILURE_MESSAGE_RE);
  }
}
 

@Override
public void decrypt(ByteBuf out, ByteBuf tag, List<ByteBuf> ciphertext)
    throws GeneralSecurityException {
  checkState(!destroyCalled);
  for (ByteBuf buf : ciphertext) {
    out.writeBytes(buf);
  }
  while (tag.isReadable()) {
    if (tag.readByte() != TAG_BYTE) {
      throw new AEADBadTagException("Tag mismatch!");
    }
  }
}
 

@Test
public void isMatchingCanary_whenDecryptThrowsAEADBadTagException_returnsFalse() throws Exception {
  subject = new LunaKeyProxy(encryptionKey,
    new PasswordEncryptionService(new TestPasswordKeyProxyFactory()) {
      @Override
      public String decrypt(final Key key, final byte[] encryptedValue, final byte[] nonce)
        throws Exception {
        throw new AEADBadTagException();
      }
    });

  assertThat(subject.matchesCanary(mock(EncryptionKeyCanary.class)), equalTo(false));
}
 

@Test
public void mapUuidsToKeys_whenTheActiveKeyIsTheOnlyKey_whenThereIsNoMatchingCanaryInTheDatabase_whenDecryptingWithTheWrongKeyRaisesAnInternalException_itShouldCreateACanaryForTheKey()
  throws Exception {
  when(encryptionKeysConfiguration.isKeyCreationEnabled()).thenReturn(true);
  when(encryptionKeysConfiguration.getProviders().get(0).getKeys()).thenReturn(asList(activeKeyData));
  when(encryptionKeysConfiguration.getProviders()).thenReturn(asList(activeProvider));
  final EncryptionKeyCanary nonMatchingCanary = new EncryptionKeyCanary();

  nonMatchingCanary.setUuid(UUID.randomUUID());
  nonMatchingCanary.setEncryptedCanaryValue("fake-non-matching-encrypted-value".getBytes(UTF_8));
  nonMatchingCanary.setNonce("fake-non-matching-nonce".getBytes(UTF_8));

  when(encryptionKeyCanaryDataService.findAll())
    .thenReturn(asArrayList(nonMatchingCanary));

  when(encryptionService
    .decrypt(activeKey, nonMatchingCanary.getEncryptedCanaryValue(),
      nonMatchingCanary.getNonce()))
    .thenThrow(new AEADBadTagException());
  when(encryptionKeyCanaryDataService.save(any(EncryptionKeyCanary.class)))
    .thenReturn(activeKeyCanary);
  when(encryptionService.encrypt(any(EncryptionKey.class), eq(CANARY_VALUE))).thenReturn(new EncryptedValue(
    null,
    "fake-encrypted-value",
    "fake-nonce"));

  subject = new EncryptionKeyCanaryMapper(encryptionKeyCanaryDataService,
    encryptionKeysConfiguration, timedRetry, providerFactory);

  subject.mapUuidsToKeys(keySet);

  assertCanaryValueWasEncryptedAndSavedToDatabase();
}
 

/** Test reflected ciphertext. */
public static void reflectedCiphertextTest(Handshakers handshakers, RegisterRef ref)
    throws GeneralSecurityException {
  performHandshake(DEFAULT_TRANSPORT_BUFFER_SIZE, handshakers);

  TsiFrameProtector sender = handshakers.getClient().createFrameProtector(alloc);
  TsiFrameProtector receiver = handshakers.getServer().createFrameProtector(alloc);

  String message = "hello world";
  ByteBuf plaintextBuffer = Unpooled.wrappedBuffer(message.getBytes(UTF_8));
  final List<ByteBuf> protectOut = new ArrayList<>();
  List<Object> unprotectOut = new ArrayList<>();

  sender.protectFlush(
      Collections.singletonList(plaintextBuffer),
      new Consumer<ByteBuf>() {
        @Override
        public void accept(ByteBuf buf) {
          protectOut.add(buf);
        }
      },
      alloc);
  assertThat(protectOut.size()).isEqualTo(1);

  ByteBuf protect = ref.register(protectOut.get(0));
  try {
    sender.unprotect(protect.slice(), unprotectOut, alloc);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().contains(DECRYPTION_FAILURE_RE);
  }

  sender.destroy();
  receiver.destroy();
}
 

/** Test reflected ciphertext. */
public static void reflectedCiphertextTest(Handshakers handshakers, RegisterRef ref)
    throws GeneralSecurityException {
  performHandshake(DEFAULT_TRANSPORT_BUFFER_SIZE, handshakers);

  TsiFrameProtector sender = handshakers.getClient().createFrameProtector(alloc);
  TsiFrameProtector receiver = handshakers.getServer().createFrameProtector(alloc);

  String message = "hello world";
  ByteBuf plaintextBuffer = Unpooled.wrappedBuffer(message.getBytes(UTF_8));
  final List<ByteBuf> protectOut = new ArrayList<>();
  List<Object> unprotectOut = new ArrayList<>();

  sender.protectFlush(
      Collections.singletonList(plaintextBuffer),
      new Consumer<ByteBuf>() {
        @Override
        public void accept(ByteBuf buf) {
          protectOut.add(buf);
        }
      },
      alloc);
  assertThat(protectOut.size()).isEqualTo(1);

  ByteBuf protect = ref.register(protectOut.get(0));
  try {
    sender.unprotect(protect.slice(), unprotectOut, alloc);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().containsMatch(DECRYPTION_FAILURE_RE);
  }

  sender.destroy();
  receiver.destroy();
}
 

@Override
public void decrypt(ByteBuf out, ByteBuf tag, List<ByteBuf> ciphertext)
    throws GeneralSecurityException {
  checkState(!destroyCalled);
  for (ByteBuf buf : ciphertext) {
    out.writeBytes(buf);
  }
  while (tag.isReadable()) {
    if (tag.readByte() != TAG_BYTE) {
      throw new AEADBadTagException("Tag mismatch!");
    }
  }
}
 

static void gcm_AEADBadTag() throws Exception {
    Cipher c;
    byte[] read = new byte[200];

    System.out.println("Running gcm_AEADBadTag");

    // Encrypt 100 bytes with AES/GCM/PKCS5Padding
    byte[] ct = encryptedText("GCM", 100);
    // Corrupt the encrypted message
    ct = corruptGCM(ct);
    // Create stream for decryption
    CipherInputStream in = getStream("GCM", ct);

    try {
        int size = in.read(read);
        throw new RuntimeException("Fail: CipherInputStream.read() " +
                "returned " + size + " and didn't throw an exception.");
    } catch (IOException e) {
        Throwable ec = e.getCause();
        if (ec instanceof AEADBadTagException) {
            System.out.println("  Pass.");
        } else {
            System.out.println("  Fail: " + ec.getMessage());
            throw new RuntimeException(ec);
        }
    } finally {
        in.close();
    }
}
 

public static void main(String[] args) throws Exception {
    newGCMParameterSpecFail(-1, bytes);
    newGCMParameterSpecFail(128, null);
    newGCMParameterSpecPass(128, bytes);

    newGCMParameterSpecFail(-1, bytes, 2, 4);
    newGCMParameterSpecFail(128, null, 2, 4);
    newGCMParameterSpecFail(128, bytes, -2, 4);
    newGCMParameterSpecFail(128, bytes, 2, -4);
    newGCMParameterSpecFail(128, bytes, 2, 15);  // one too many

    newGCMParameterSpecPass(128, bytes, 2, 14);  // ok.
    newGCMParameterSpecPass(96, bytes, 4, 4);
    newGCMParameterSpecPass(96, bytes, 0, 0);

    // Might as well check the Exception constructors.
    try {
        new AEADBadTagException();
        new AEADBadTagException("Bad Tag Seen");
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }

    if (failed != 0) {
        throw new Exception("Test(s) failed");
    }
}
 

public static void main(String[] args) throws Exception {
    newGCMParameterSpecFail(-1, bytes);
    newGCMParameterSpecFail(128, null);
    newGCMParameterSpecPass(128, bytes);

    newGCMParameterSpecFail(-1, bytes, 2, 4);
    newGCMParameterSpecFail(128, null, 2, 4);
    newGCMParameterSpecFail(128, bytes, -2, 4);
    newGCMParameterSpecFail(128, bytes, 2, -4);
    newGCMParameterSpecFail(128, bytes, 2, 15);  // one too many

    newGCMParameterSpecPass(128, bytes, 2, 14);  // ok.
    newGCMParameterSpecPass(96, bytes, 4, 4);
    newGCMParameterSpecPass(96, bytes, 0, 0);

    // Might as well check the Exception constructors.
    try {
        new AEADBadTagException();
        new AEADBadTagException("Bad Tag Seen");
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }

    if (failed != 0) {
        throw new Exception("Test(s) failed");
    }
}
 

public static void main(String[] args) throws Exception {
    newGCMParameterSpecFail(-1, bytes);
    newGCMParameterSpecFail(128, null);
    newGCMParameterSpecPass(128, bytes);

    newGCMParameterSpecFail(-1, bytes, 2, 4);
    newGCMParameterSpecFail(128, null, 2, 4);
    newGCMParameterSpecFail(128, bytes, -2, 4);
    newGCMParameterSpecFail(128, bytes, 2, -4);
    newGCMParameterSpecFail(128, bytes, 2, 15);  // one too many

    newGCMParameterSpecPass(128, bytes, 2, 14);  // ok.
    newGCMParameterSpecPass(96, bytes, 4, 4);
    newGCMParameterSpecPass(96, bytes, 0, 0);

    // Might as well check the Exception constructors.
    try {
        new AEADBadTagException();
        new AEADBadTagException("Bad Tag Seen");
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }

    if (failed != 0) {
        throw new Exception("Test(s) failed");
    }
}
 

@Test
public void reflection() throws GeneralSecurityException {
  String message = "Hello world";
  FrameEncrypt frameEncrypt = createFrameEncrypt(message);
  client.encrypt(frameEncrypt.out, frameEncrypt.plain);
  FrameDecrypt frameDecrypt = frameDecryptOfEncrypt(frameEncrypt);
  try {
    client.decrypt(frameDecrypt.out, frameDecrypt.tag, frameDecrypt.ciphertext);
    fail("Exception expected");
  } catch (AEADBadTagException ex) {
    assertThat(ex).hasMessageThat().contains(DECRYPTION_FAILURE_MESSAGE);
  }
}
 

static void gcm_AEADBadTag() throws Exception {
    Cipher c;
    byte[] read = new byte[200];

    System.out.println("Running gcm_AEADBadTag");

    // Encrypt 100 bytes with AES/GCM/PKCS5Padding
    byte[] ct = encryptedText("GCM", 100);
    // Corrupt the encrypted message
    ct = corruptGCM(ct);
    // Create stream for decryption
    CipherInputStream in = getStream("GCM", ct);

    try {
        int size = in.read(read);
        throw new RuntimeException("Fail: CipherInputStream.read() " +
                "returned " + size + " and didn't throw an exception.");
    } catch (IOException e) {
        Throwable ec = e.getCause();
        if (ec instanceof AEADBadTagException) {
            System.out.println("  Pass.");
        } else {
            System.out.println("  Fail: " + ec.getMessage());
            throw new RuntimeException(ec);
        }
    } finally {
        in.close();
    }
}
 

public static void main(String[] args) throws Exception {
    newGCMParameterSpecFail(-1, bytes);
    newGCMParameterSpecFail(128, null);
    newGCMParameterSpecPass(128, bytes);

    newGCMParameterSpecFail(-1, bytes, 2, 4);
    newGCMParameterSpecFail(128, null, 2, 4);
    newGCMParameterSpecFail(128, bytes, -2, 4);
    newGCMParameterSpecFail(128, bytes, 2, -4);
    newGCMParameterSpecFail(128, bytes, 2, 15);  // one too many

    newGCMParameterSpecPass(128, bytes, 2, 14);  // ok.
    newGCMParameterSpecPass(96, bytes, 4, 4);
    newGCMParameterSpecPass(96, bytes, 0, 0);

    // Might as well check the Exception constructors.
    try {
        new AEADBadTagException();
        new AEADBadTagException("Bad Tag Seen");
    } catch (Exception e) {
        e.printStackTrace();
        failed++;
    }

    if (failed != 0) {
        throw new Exception("Test(s) failed");
    }
}
 

@Test
public void matchesCanary_shouldReturnFalse_IfTheInternalKeyWasWrong() throws Exception {
  when(encryptionProvider.decrypt(any(), any(), any())).thenThrow(AEADBadTagException.class);

  subject = new ExternalKeyProxy(encryptionKeyMetadata, encryptionProvider);
  assertFalse(subject.matchesCanary(encryptionKeyCanary));
}