throw new PACDecodingException("Malformed kerberos token");
            }

            ASN1TaggedObject mechToken = ASN1Util.as(ASN1TaggedObject.class, stream.readObject());
            if (mechToken == null || mechToken.getTagClass() != BERTags.APPLICATION
                    || !(mechToken.getBaseObject() instanceof ASN1Sequence)) {
                throw new PACDecodingException("Malformed kerberos token");
            }

            new KerberosRelevantAuthData(malformedToken, keys);
        }, "A PACDecodingException should be thrown for a malformed token.");

        assertEquals("Malformed kerberos ticket", exception.getMessage(), "The exception message should indicate a malformed ticket.");
    }

    /**
     * Test constructor with an empty token.

                throw new IOException("Malformed SPNEGO token " + constructed);
            }

            final ASN1Sequence vec = (ASN1Sequence) constructed.getBaseObject();

            final ASN1ObjectIdentifier spnego = (ASN1ObjectIdentifier) vec.getObjectAt(0);
            if (!SPNEGO_OID.equals(spnego)) {
                throw new IOException("Malformed SPNEGO token, OID " + spnego);
            }

                    throw new PACDecodingException("Malformed Kerberos Ticket");
                }
                try {
                    this.ticket = new KerberosTicket(derTicket.getBaseObject().getEncoded(), this.apOptions, keys);
                } catch (IOException e) {
                    throw new PACDecodingException("Malformed Kerberos Ticket", e);
                }
                break;

    }

    /**
     * Test constructor with KERB_CHECKSUM_HMAC_MD5 type.
     *
     * @throws IOException if an I/O error occurs
     * @throws PACDecodingException if the PAC is malformed
     */
    @Test
    void testConstructorKerbChecksumHmacMd5() throws IOException, PACDecodingException {
        // Prepare data
        ByteArrayOutputStream baos = new ByteArrayOutputStream();

    }

    @Test
    @DisplayName("parsing malformed token throws IOException")
    void testMalformedToken() {
        byte[] bad = new byte[] { 0x01, 0x02, 0x03 }; // not a valid ASN.1 tagged object
        assertThrows(IOException.class, () -> new NegTokenTarg(bad), "Malformed byte[] should cause IOException");
    }

    @Test

          }
          else -> return false // Malformed.
        }
      }
      pos++ // Consume '-'.
    }

    var n = INITIAL_N
    var i = 0
    var bias = INITIAL_BIAS

    while (pos < limit) {
      val oldi = i
      var w = 1
      for (k in BASE until Int.MAX_VALUE step BASE) {
        if (pos == limit) return false // Malformed.
        val c = string[pos++]
        val digit =

    void testConstructorWithEmptyToken() {
        byte[] emptyToken = new byte[0];
        assertThrows(PACDecodingException.class, () -> new KerberosToken(emptyToken));
    }

    /**
     * Test constructor with a malformed token (not ASN.1).
     */
    @Test
    void testConstructorWithMalformedToken() {
        byte[] malformedToken = "This is not a valid token".getBytes();

    private byte[] checksum;

    /**
     * Constructs a PacSignature by parsing the provided data.
     *
     * @param data the raw signature data to parse
     * @throws PACDecodingException if the data is malformed or cannot be parsed
     */
    public PacSignature(final byte[] data) throws PACDecodingException {
        try {

     * @param data the raw PAC data bytes
     * @param keys map of Kerberos keys for signature validation
     * @throws PACDecodingException if the PAC data is malformed or signature validation fails
     */
    public Pac(byte[] data, Map<Integer, KerberosKey> keys) throws PACDecodingException {
        byte[] checksumData = data.clone();
        try {