}
        else {
            javaChecksum = sun.security.krb5.internal.crypto.Aes256.calculateChecksum(keybytes, usage, bytes, 0, bytes.length);
        }

        byte[] mac = PacMac.calculateMacHMACAES(usage, makeKey(keybytes, keybytes.length == 16 ? 17 : 18), bytes);
        checkBytes(javaChecksum, mac);
        checkBytes(Hex.decode(expect), mac);
    }

    public NegTokenInit ( ASN1ObjectIdentifier[] mechanisms, int contextFlags, byte[] mechanismToken, byte[] mechanismListMIC ) {
        setMechanisms(mechanisms);
        setContextFlags(contextFlags);
        setMechanismToken(mechanismToken);
        setMechanismListMIC(mechanismListMIC);
    }


    public NegTokenInit ( byte[] token ) throws IOException {
        parse(token);
    }

     *
     * BC no longer seems to allow that out of the box
     *
     * @param expectTag
     * @param in
     * @return coded bytes of the tagged object
     * @throws IOException
     */
    public static byte[] readUnparsedTagged(int expectTag, int limit, ASN1InputStream in) throws IOException {
        int ftag = in.read();
        int tag = readTagNumber(in, ftag);