private static AeadCipher makeAesGcmCipher(SecretSharedKey secretSharedKey, boolean forEncryption) {
        var aeadParams = new AEADParameters(new KeyParameter(secretSharedKey.secretKey().getEncoded()),
                                            AES_GCM_AUTH_TAG_BITS, FIXED_96BIT_IV_FOR_SINGLE_USE_KEY);
        var cipher = GCMBlockCipher.newInstance(AESEngine.newInstance());
        cipher.init(forEncryption, aeadParams);
        return AeadCipher.of(cipher);
    }
Implements both the sender and receiver sides of a secure, anonymous one-way
key generation and exchange protocol implemented using HPKE; a hybrid crypto
scheme built around elliptic curves.

A shared key, once generated, may have its sealed component sent over a public
channel without revealing anything about the underlying secret key. Only a
recipient holding the private key corresponding to the public used for shared
key creation may derive the same secret key as the sender.

Every generated key is globally unique (with extremely high probability).

The secret key is intended to be used <em>only once</em>. It MUST NOT be used to
produce more than a single ciphertext. Using the secret key to produce multiple
ciphertexts completely breaks the security model due to using a fixed Initialization
Vector (IV).
security-utils/src/main/java/com/yahoo/security/SharedKeyGenerator.java