@Test
public void decrypt_modifiedCiphertext() throws GeneralSecurityException {

  if (TestUtil.isTsan()) {
    // RsaKem.generateRsaKeyPair is too slow in Tsan.
    return;
  }
  KeyPair keyPair = RsaKem.generateRsaKeyPair(2048);
  String hmacAlgo = "HMACSHA256";
  byte[] salt = Random.randBytes(20);
  RSAPublicKey rsaPublicKey = (RSAPublicKey) keyPair.getPublic();
  HybridEncrypt hybridEncrypt =
      new RsaKemHybridEncrypt(rsaPublicKey, hmacAlgo, salt, new AesGcmFactory(16));
  RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) keyPair.getPrivate();
  HybridDecrypt hybridDecrypt =
      new RsaKemHybridDecrypt(rsaPrivateKey, hmacAlgo, salt, new AesGcmFactory(16));
  byte[] plaintext = Random.randBytes(20);
  byte[] context = Random.randBytes(20);
  byte[] ciphertext = hybridEncrypt.encrypt(plaintext, context);
  // Modifies ciphertext and makes sure that the decryption failed. This test implicitly checks
  // the modification of public key and the raw ciphertext.
  for (TestUtil.BytesMutation mutation : TestUtil.generateMutations(ciphertext)) {
    assertThrows(
        GeneralSecurityException.class, () -> hybridDecrypt.decrypt(mutation.value, context));
  }
}