final AEADBlockCipher cipher;

        if (keyLength == 16) {
            // AES-128 CCM
            cipher = new CCMBlockCipher(new AESEngine());
        } else if (keyLength == 32) {
            // AES-256 CCM - Bouncy Castle supports AES-256 with same AESEngine
            cipher = new CCMBlockCipher(new AESEngine());
        } else {
            throw new IllegalArgumentException("Unsupported key length for CCM: " + keyLength);