assertNotNull(nonce2, "Second nonce should not be null");
        assertEquals(12, nonce1.length, "CCM nonce should be 12 bytes");
        assertEquals(12, nonce2.length, "CCM nonce should be 12 bytes");
        assertFalse(Arrays.equals(nonce1, nonce2), "Consecutive nonces should be different");

        // For CCM, verify counter-based generation (first 8 bytes contain counter)

            setField(transport, "negotiated", smb300);
            Smb2EncryptionContext ccm = transport.createEncryptionContext(sessionKey, preauth);
            assertEquals(EncryptionNegotiateContext.CIPHER_AES128_CCM, ccm.getCipherId());
            assertEquals(DialectVersion.SMB300, ccm.getDialect());

            // SMB 3.1.1 -> default AES-128-GCM when server did not choose

        // Support both AES-128 and AES-256 for CCM cipher
        int keyLength = getKeyLength();
        final AEADBlockCipher cipher;

        if (keyLength == 16) {
            // AES-128 CCM
            cipher = new CCMBlockCipher(new AESEngine());
        } else if (keyLength == 32) {
            // AES-256 CCM - Bouncy Castle supports AES-256 with same AESEngine