// Provide a common OID for tests (Kerberos V5 mechanism OID encoded in DER)
    private static ASN1ObjectIdentifier testOid() {
        return new ASN1ObjectIdentifier("1.2.840.113554.1.2.2");
    }

    private static byte[] oidDer() {
        // Full DER encoding of the OID
        try {
            return testOid().toASN1Primitive().getEncoded();
        } catch (java.io.IOException e) {
            throw new RuntimeException(e);