@Test
public void decrypt_modifiedSalt() throws GeneralSecurityException {

  if (TestUtil.isTsan()) {
    // RsaKem.generateRsaKeyPair is too slow in Tsan.
    return;
  }
  KeyPair keyPair = RsaKem.generateRsaKeyPair(2048);
  String hmacAlgo = "HMACSHA256";
  byte[] salt = Random.randBytes(20);
  RSAPublicKey rsaPublicKey = (RSAPublicKey) keyPair.getPublic();
  HybridEncrypt hybridEncrypt =
      new RsaKemHybridEncrypt(rsaPublicKey, hmacAlgo, salt, new AesGcmFactory(16));
  byte[] plaintext = Random.randBytes(20);
  byte[] context = Random.randBytes(20);
  byte[] ciphertext = hybridEncrypt.encrypt(plaintext, context);
  RSAPrivateKey rsaPrivateKey = (RSAPrivateKey) keyPair.getPrivate();
  // We exclude tests that modify the length of the salt, since the salt has fixed length and
  // modifying the length may not be detected.
  for (int bytes = 0; bytes < salt.length; bytes++) {
    for (int bit = 0; bit < 8; bit++) {
      byte[] modifiedSalt = Arrays.copyOf(salt, salt.length);
      modifiedSalt[bytes] ^= (byte) (1 << bit);
      HybridDecrypt hybridDecrypt =
          new RsaKemHybridDecrypt(rsaPrivateKey, hmacAlgo, modifiedSalt, new AesGcmFactory(16));
      assertThrows(
          GeneralSecurityException.class, () -> hybridDecrypt.decrypt(ciphertext, context));
    }
  }
}