void testConstructorWithConfigAndCiphers() {
            int[] ciphers = { EncryptionNegotiateContext.CIPHER_AES128_CCM, EncryptionNegotiateContext.CIPHER_AES128_GCM };

            EncryptionNegotiateContext context = new EncryptionNegotiateContext(mockConfig, ciphers);

            assertNotNull(context);
            assertArrayEquals(ciphers, context.getCiphers());
        }

        void testConstructorWithParameters() {
            int[] ciphers = { EncryptionNegotiateContext.CIPHER_AES128_CCM, EncryptionNegotiateContext.CIPHER_AES128_GCM };

            context = new EncryptionNegotiateContext(mockConfig, ciphers);

            assertEquals(EncryptionNegotiateContext.NEGO_CTX_ENC_TYPE, context.getContextType());
            assertArrayEquals(ciphers, context.getCiphers());
        }

        @Test

            // Assert
            // Note: size() returns 4 + (2*ciphers.length) but encode only writes 2 + (2*ciphers.length)
            // This appears to be a bug in the implementation, but we test the actual behavior
            assertEquals(6, encodedSize); // actual encoded size: 2 bytes count + 2*2 bytes for ciphers
            assertEquals(2, buffer[0]); // cipher count (little endian)
            assertEquals(0, buffer[1]);

  private val handshakeCertificates = platform.localhostHandshakeCertificates()

  /** Ciphers in order we observed directly on the socket. */
  private lateinit var handshakeEnabledCipherSuites: List<String>

  /** Ciphers in order we observed on sslSocketFactory defaults. */
  private lateinit var defaultEnabledCipherSuites: List<String>

  /** Ciphers in order we observed on sslSocketFactory supported. */

	ssh.KeyAlgoSKED25519, ssh.KeyAlgoSKECDSA256,
	ssh.KeyAlgoECDSA256, ssh.KeyAlgoECDSA384, ssh.KeyAlgoECDSA521,
	ssh.KeyAlgoRSASHA256, ssh.KeyAlgoRSASHA512, ssh.KeyAlgoRSA,
	ssh.KeyAlgoDSA,
}

// supportedCiphers lists ciphers we support but might not recommend.
// https://cs.opensource.google/go/x/crypto/+/refs/tags/v0.22.0:ssh/common.go;l=28
var supportedCiphers = []string{
	"aes128-ctr", "aes192-ctr", "aes256-ctr",

            final Cipher cipher = Cipher.getInstance(transformation);
            final GCMParameterSpec gcmSpec = new GCMParameterSpec(getAuthTagLength() * 8, nonce);

            cipher.init(encrypt ? Cipher.ENCRYPT_MODE : Cipher.DECRYPT_MODE, keySpec, gcmSpec);
            return cipher;
        } finally {
            // Guaranteed cleanup of all key material
            if (key != null) {

     * @return a decryption cipher
     */
    protected Cipher pollDecryptoCipher() {
        Cipher cipher = decryptoQueue.poll();
        if (cipher == null) {
            final SecretKeySpec sksSpec = new SecretKeySpec(key.getBytes(), algorithm);
            try {
                cipher = Cipher.getInstance(algorithm);
                cipher.init(Cipher.DECRYPT_MODE, sksSpec);
            } catch (final InvalidKeyException e) {

with certificates and the privacy of data exchanged with strong ciphers.

When negotiating a connection to an HTTPS server, OkHttp needs to know which [TLS versions](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-tls-version/) and [cipher suites](https://square.github.io/okhttp/4.x/okhttp/okhttp3/-cipher-suite/) to offer. A client that wants to maximize connectivity would include obsolete TLS versions and weak-by-design cipher suites. A strict client that wants to maximize security would...

    @Test
    @DisplayName("Should return selected cipher")
    void testGetSelectedCipher() throws Exception {
        // Given
        setPrivateField(response, "selectedCipher", EncryptionNegotiateContext.CIPHER_AES128_GCM);

        // When
        int cipher = response.getSelectedCipher();

        // Then
        assertEquals(EncryptionNegotiateContext.CIPHER_AES128_GCM, cipher);
    }

    @Test

     *
     * @return preferred encryption cipher list in order of preference for SMB3 encryption
     * @since 2.2
     */
    String getPreferredCiphers();

    /**
     * Property {@code jcifs.smb.client.aes256Enabled} (boolean, default true)
     *
     * @return whether AES-256 encryption ciphers are enabled for SMB3.x
     * @since 2.2
     */
    boolean isAES256Enabled();