@Test
public void testGenerateEncryptedKey() throws Exception {

  // Generate a new EEK and check it
  KeyProviderCryptoExtension.EncryptedKeyVersion ek1 = 
      kpExt.generateEncryptedKey(encryptionKey.getName());
  assertEquals("Version name of EEK should be EEK",
      KeyProviderCryptoExtension.EEK,
      ek1.getEncryptedKeyVersion().getVersionName());
  assertEquals("Name of EEK should be encryption key name",
      ENCRYPTION_KEY_NAME, ek1.getEncryptionKeyName());
  assertNotNull("Expected encrypted key material",
      ek1.getEncryptedKeyVersion().getMaterial());
  assertEquals("Length of encryption key material and EEK material should "
          + "be the same", encryptionKey.getMaterial().length,
      ek1.getEncryptedKeyVersion().getMaterial().length
  );
  // Decrypt EEK into an EK and check it
  KeyVersion k1 = kpExt.decryptEncryptedKey(ek1);
  assertEquals(KeyProviderCryptoExtension.EK, k1.getVersionName());
  assertEquals(encryptionKey.getMaterial().length, k1.getMaterial().length);
  // Decrypt it again and it should be the same
  KeyVersion k1a = kpExt.decryptEncryptedKey(ek1);
  assertArrayEquals(k1.getMaterial(), k1a.getMaterial());
  // Generate another EEK and make sure it's different from the first
  KeyProviderCryptoExtension.EncryptedKeyVersion ek2 = 
      kpExt.generateEncryptedKey(encryptionKey.getName());
  KeyVersion k2 = kpExt.decryptEncryptedKey(ek2);
  if (Arrays.equals(k1.getMaterial(), k2.getMaterial())) {
    fail("Generated EEKs should have different material!");
  }
  if (Arrays.equals(ek1.getEncryptedKeyIv(), ek2.getEncryptedKeyIv())) {
    fail("Generated EEKs should have different IVs!");
  }
}