// Then
        assertNotNull(signingKey, "Signing key should not be null");
        assertEquals(16, signingKey.length, "Signing key should be 16 bytes");
        assertFalse(Arrays.equals(sessionKey, signingKey), "Signing key should be different from session key");
    }

    @Test
    @DisplayName("Should derive signing key for SMB 3.1.1 dialect")
    void testDeriveSigningKey_SMB311() {
        // Given

import jcifs.internal.SMBSigningDigest;
import jcifs.internal.util.SMBUtil;
import jcifs.util.Crypto;

/**
 * SMB2/SMB3 message signing digest implementation.
 *
 * This class handles cryptographic signing of SMB2/SMB3 messages to ensure
 * message integrity and authenticity. It supports different signing algorithms
 * used in various SMB2/SMB3 dialect versions.
 *
 * @author mbechler
 */

    }

    /**
     * Constructs a signing digest with bypass option and initial sequence number
     *
     * @param macSigningKey
     *            The MAC signing key used for generating signatures
     * @param bypass
     *            Whether to bypass signature verification
     * @param initialSequence
     *            The initial sequence number for signing
     */

     * @param tc
     *            context to use
     * @param auth
     *            credentials
     * @param doSigning
     *            whether signing is requested
     */
    public NtlmContext(final CIFSContext tc, final NtlmPasswordAuthenticator auth, final boolean doSigning) {
        this.transportContext = tc;
        this.auth = auth;

        assertFalse(result);
        verify(negotiationResponse).canReuse(null, false);
    }

    @Test
    @DisplayName("Test signing state combinations")
    void testSigningStateCombinations() {
        // Test all combinations of signing states

        // Signing disabled
        when(negotiationResponse.isSigningEnabled()).thenReturn(false);
        when(negotiationResponse.isSigningRequired()).thenReturn(false);

    class NegotiationConstants {

        @Test
        @DisplayName("Signing enabled flag should be 0x0001")
        void testSigningEnabledFlag() {
            assertEquals(0x0001, Smb2Constants.SMB2_NEGOTIATE_SIGNING_ENABLED, "Signing enabled flag must be 0x0001");
        }

        @Test
        @DisplayName("Signing required flag should be 0x0002")
        void testSigningRequiredFlag() {

    }

    @Test
    @DisplayName("Test constructor with MAC signing key and bypass flag")
    void testConstructorWithBypass() {
        SMB1SigningDigest digest = new SMB1SigningDigest(testMacSigningKey, true);
        assertNotNull(digest);
        assertTrue(digest.toString().contains("MacSigningKey="));
    }

    @Test
    @DisplayName("Test constructor with MAC signing key, bypass flag and initial sequence")

                            && !conn.getNegotiateResponse().isSigningRequired()) {
                        // if signing is not enforced, dont use connections that have signing enforced
                        // for purposes that dont require it.
                        if (log.isTraceEnabled()) {
                            log.debug("Cannot reuse, signing enforced on connection " + conn);
                        }
                        continue;

        assertFalse(transport.isSigningEnforced());
        verify(transport).isSigningOptional();
        verify(transport).isSigningEnforced();
    }

    // Error propagation: signing checks may throw SmbException
    @Test
    @DisplayName("signing checks propagate SmbException")
    void signingChecks_throw() throws Exception {
        doThrow(new SmbException("opt error")).when(transport).isSigningOptional();

        default -> getNTLMResponse(password, challenge);
        };
    }

    /**
     * Returns the signing key for SMB signing.
     *
     * @param challenge the server challenge bytes
     * @return the signing key
     * @throws SmbException if an error occurs generating the signing key
     */
    public byte[] getSigningKey(final byte[] challenge) throws SmbException {
        switch (LM_COMPATIBILITY) {