@Test
public void rotate_reEncryptsPasswordWithNewEncryptionKey() {

  final UUID oldEncryptionKeyUuid = UUID.randomUUID();
  final byte[] oldEncryptedPassword = "old-encrypted-password".getBytes(UTF_8);
  final byte[] oldEncryptedGenerationParams = "old-encrypted-generation-params".getBytes(UTF_8);
  final byte[] oldNonce = "old-nonce".getBytes(UTF_8);
  final byte[] oldParametersNonce = "old-parameters-nonce".getBytes(UTF_8);
  final EncryptedValue parametersEncryption = new EncryptedValue(oldEncryptionKeyUuid, oldEncryptedGenerationParams, oldParametersNonce);
  final EncryptedValue encryptedUserValue = new EncryptedValue();
  encryptedUserValue.setEncryptionKeyUuid(oldEncryptionKeyUuid);
  encryptedUserValue.setEncryptedValue(oldEncryptedPassword);
  encryptedUserValue.setNonce(oldNonce);
  userCredentialData = new UserCredentialVersionData(CREDENTIAL_NAME);
  userCredentialData.setEncryptedValueData(encryptedUserValue);
  userCredentialData.setEncryptedGenerationParameters(parametersEncryption);
  subject = new UserCredentialVersion(userCredentialData);
  subject.setEncryptor(encryptor);
  when(encryptor.decrypt(new EncryptedValue(oldEncryptionKeyUuid, oldEncryptedPassword, oldNonce)))
    .thenReturn(USER_PASSWORD);
  when(encryptor.decrypt(new EncryptedValue(oldEncryptionKeyUuid, oldEncryptedGenerationParams, oldParametersNonce)))
    .thenReturn(userGenerationParametersString);
  when(encryptor.encrypt(eq(USER_PASSWORD)))
    .thenReturn(new EncryptedValue(ENCRYPTION_KEY_UUID, ENCRYPTED_PASSWORD, NONCE));
  when(encryptor.encrypt(eq(userGenerationParametersString)))
    .thenReturn(new EncryptedValue(ENCRYPTION_KEY_UUID, ENCRYPTED_GENERATION_PARAMS, PARAMETERS_NONCE));
  subject.rotate();
  verify(encryptor, times(2)).decrypt(any());
  verify(encryptor).encrypt(USER_PASSWORD);
  verify(encryptor).encrypt(userGenerationParametersString);
  assertThat(userCredentialData.getEncryptionKeyUuid(), equalTo(ENCRYPTION_KEY_UUID));
  assertThat(userCredentialData.getEncryptedValueData().getEncryptedValue(), equalTo(ENCRYPTED_PASSWORD));
  assertThat(userCredentialData.getEncryptedGenerationParameters().getEncryptedValue(), equalTo(ENCRYPTED_GENERATION_PARAMS));
  assertThat(userCredentialData.getNonce(), equalTo(NONCE));
  assertThat(userCredentialData.getEncryptedGenerationParameters().getNonce(), equalTo(PARAMETERS_NONCE));
}