assertNotNull(nonce2, "Second nonce should not be null");
        assertEquals(12, nonce1.length, "CCM nonce should be 12 bytes");
        assertEquals(12, nonce2.length, "CCM nonce should be 12 bytes");
        assertFalse(Arrays.equals(nonce1, nonce2), "Consecutive nonces should be different");

        // For CCM, verify counter-based generation (first 8 bytes contain counter)

    }

    /**
     * Sets the nonce for encryption
     *
     * @param nonce
     *            the nonce to set (12 bytes for CCM, 16 bytes for GCM)
     */
    public void setNonce(final byte[] nonce) {
        if (nonce.length == 12) {
            // For CCM cipher, pad nonce to 16 bytes with zeros
            java.util.Arrays.fill(this.nonce, (byte) 0);
            System.arraycopy(nonce, 0, this.nonce, 0, 12);

            setField(transport, "negotiated", smb300);
            Smb2EncryptionContext ccm = transport.createEncryptionContext(sessionKey, preauth);
            assertEquals(EncryptionNegotiateContext.CIPHER_AES128_CCM, ccm.getCipherId());
            assertEquals(DialectVersion.SMB300, ccm.getDialect());

            // SMB 3.1.1 -> default AES-128-GCM when server did not choose

        // Support both AES-128 and AES-256 for CCM cipher
        int keyLength = getKeyLength();
        final AEADBlockCipher cipher;

        if (keyLength == 16) {
            // AES-128 CCM
            cipher = new CCMBlockCipher(new AESEngine());
        } else if (keyLength == 32) {
            // AES-256 CCM - Bouncy Castle supports AES-256 with same AESEngine

- Configurable: Min/max versions can be set via configuration properties

### SMB3 Encryption Support
- **SMB2 Transform Header**: Encrypted message wrapping
- **AES-CCM/GCM Support**: Both AES-128-CCM (SMB 3.0/3.0.2) and AES-128-GCM (SMB 3.1.1) cipher suites
- **Encryption Context**: Per-session encryption state management
- **Key Derivation**: SMB3 KDF implementation with dialect-specific parameters

    /**
     * Context type
     */
    public static final int NEGO_CTX_ENC_TYPE = 0x2;

    /**
     * AES 128 CCM
     */
    public static final int CIPHER_AES128_CCM = 0x1;

    /**
     * AES 128 GCM
     */
    public static final int CIPHER_AES128_GCM = 0x2;

    /**
     * AES 256 CCM
     */
    public static final int CIPHER_AES256_CCM = 0x3;

    /**
     * AES 256 GCM
     */

            if (config.isEncryptionEnabled()) {
                // Build cipher list based on AES-256 support
                List<Integer> ciphers = new ArrayList<>();

                // Prefer GCM over CCM for better performance
                if (config.isAES256Enabled()) {
                    ciphers.add(EncryptionNegotiateContext.CIPHER_AES256_GCM);
                    ciphers.add(EncryptionNegotiateContext.CIPHER_AES256_CCM);

                cipherId = EncryptionNegotiateContext.CIPHER_AES128_GCM;
            }
        } else if (dialect.atLeast(DialectVersion.SMB300)) {
            // SMB 3.0/3.0.2 only supports AES-128-CCM
            cipherId = EncryptionNegotiateContext.CIPHER_AES128_CCM;
        } else {
            throw new SmbUnsupportedOperationException("SMB3 required for encryption, negotiated: " + dialect);
        }

- KCM specific args can be passed with `/cluster` script, without affecting CCM. New variable name: `KUBE_CONTROLLER_MANAGER_TEST_ARGS`. ([#120524](https://github.com/kubernetes/kubernetes/pull/120524), [@jprzychodzen](https://github.com/jprzychodzen)) [SIG Cloud Provider]