pos += NTLMSSP_SIGNATURE.length;

        writeULong(type2, pos, NTLMSSP_TYPE2);
        pos += 4;

        // TargetNameFields
        int targetNameOff = writeSecurityBuffer(type2, pos, targetBytes);
        pos += 8;

        writeULong(type2, pos, flags);
        pos += 4;

        // ServerChallenge
        byte[] challengeBytes = getChallenge();