@Test
    void passes_rfc_9180_dhkem_x25519_hkdf_sha256_hkdf_sha256_aes_gcm_128_auth_test_vector() {
        byte[] info = unhex("4f6465206f6e2061204772656369616e2055726e");
        byte[] pt   = unhex("4265617574792069732074727574682c20747275746820626561757479");
        byte[] aad  = unhex("436f756e742d30");
        var kpR     = receiverRfc9180AuthTestVectorKeyPair();
        var kpS     = senderRfc9180AuthTestVectorKeyPair();

        var kem = Kem.dHKemX25519HkdfSha256(new Kem.UnsafeDeterminsticKeyPairOnlyUsedByTesting(ephemeralRfc9180AuthTestVectorKeyPair()));
        var ciphersuite = Ciphersuite.of(kem, Kdf.hkdfSha256(), Aead.aes128Gcm());

        var hpke = Hpke.of(ciphersuite);
        var s = hpke.sealAuth(pk(kpR), info, aad, pt, sk(kpS));

        // The "enc" output is the ephemeral public key
        var expectedEnc = "23fb952571a14a25e3d678140cd0e5eb47a0961bb18afcf85896e5453c312e76";
        assertEquals(expectedEnc, hex(s.enc()));

        var expectedCiphertext = "5fd92cc9d46dbf8943e72a07e42f363ed5f721212cd90bcfd072bfd9f44e06b8" +
                                 "0fd17824947496e21b680c141b";
        assertEquals(expectedCiphertext, hex(s.ciphertext()));

        byte[] openedPt = hpke.openAuth(s.enc(), sk(kpR), info, aad, s.ciphertext(), pk(kpS));
        assertEquals(hex(pt), hex(openedPt));
    }
<a href="https://www.rfc-editor.org/rfc/rfc9180.html">RFC 9180</a> test vector, Auth mode

Appendix A.1.3

DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, AES-128-GCM

Only tests first encryption, i.e. sequence number 0.
security-utils/src/test/java/com/yahoo/security/HpkeTest.java