this.negotiatedFlags2 |= SmbConstants.FLAGS2_SECURITY_SIGNATURES;
            if ( req.isSigningEnforced() || isSigningRequired() ) {
                this.negotiatedFlags2 |= SmbConstants.FLAGS2_SECURITY_REQUIRE_SIGNATURES;
            }
        }
        else {
            this.negotiatedFlags2 &= 0xFFFF ^ SmbConstants.FLAGS2_SECURITY_SIGNATURES;

    static final int FLAGS2_NONE = 0x0000;
    static final int FLAGS2_LONG_FILENAMES = 0x0001;
    static final int FLAGS2_EXTENDED_ATTRIBUTES = 0x0002;
    static final int FLAGS2_SECURITY_SIGNATURES = 0x0004;
    static final int FLAGS2_SECURITY_REQUIRE_SIGNATURES = 0x0010;
    static final int FLAGS2_EXTENDED_SECURITY_NEGOTIATION = 0x0800;
    static final int FLAGS2_RESOLVE_PATHS_IN_DFS = 0x1000;

    /**
     * @return whether signatures are supported but not required
     * @throws SmbException
     */
    boolean isSigningOptional () throws SmbException;


    /**
     * @return whether signatures are enforced from either side
     * @throws SmbException
     */
    boolean isSigningEnforced () throws SmbException;

     */
    @Override
    public boolean verifySignature ( byte[] buffer, int i, int size ) {
        // observed too that signatures on error responses are sometimes wrong??
        // Looks like the failure case also is just reflecting back the signature we sent

        // with SMB3's negotiation validation it's no longer possible to ignore this (on the validation response)

    static final int FLAGS2_LONG_FILENAMES                = 0x0001;
    static final int FLAGS2_EXTENDED_ATTRIBUTES           = 0x0002;
    static final int FLAGS2_SECURITY_SIGNATURES           = 0x0004;
    static final int FLAGS2_EXTENDED_SECURITY_NEGOTIATION = 0x0800;
    static final int FLAGS2_RESOLVE_PATHS_IN_DFS          = 0x1000;
    static final int FLAGS2_PERMIT_READ_IF_EXECUTE_PERM   = 0x2000;

        if ( !this.useNTSmbs ) {
            log.debug("No support for NT SMBs");
        }

        // there seems to be a bug with some servers that causes corruption if using signatures +
        // CAP_LARGE_WRITE
        if ( th.hasCapability(SmbConstants.CAP_LARGE_WRITEX) && !th.areSignaturesActive() ) {
            this.writeSizeFile = Math.min(th.getConfig().getSendBufferSize() - 70, 0xFFFF - 70);

    
                        break;
                    case 20:
                        if (nctx == null) {
                            boolean doSigning = (transport.flags2 & ServerMessageBlock.FLAGS2_SECURITY_SIGNATURES) != 0;
                            nctx = new NtlmContext(auth, doSigning);
                        }
    
                        if (SmbTransport.log.level >= 4)

                    | ( this.useExtendedSecurity ? SmbConstants.FLAGS2_EXTENDED_SECURITY_NEGOTIATION : 0 )
                    | ( this.signingPreferred ? SmbConstants.FLAGS2_SECURITY_SIGNATURES : 0 )
                    | ( this.useNtStatus ? SmbConstants.FLAGS2_STATUS32 : 0 )
                    | ( this.useUnicode || this.forceUnicode ? SmbConstants.FLAGS2_UNICODE : 0 );
        }

        if (server.signaturesRequired || (server.signaturesEnabled && SIGNPREF)) {
            flags2 |= ServerMessageBlock.FLAGS2_SECURITY_SIGNATURES;
        } else {
            flags2 &= 0xFFFF ^ ServerMessageBlock.FLAGS2_SECURITY_SIGNATURES;
        }
        maxMpxCount = Math.min( maxMpxCount, server.maxMpxCount );
        if (maxMpxCount < 1) maxMpxCount = 1;

            update(data, index, length - SmbConstants.SIGNATURE_OFFSET - 8);
            update(raxr.getData(), raxr.getOffset(), raxr.getDataLength());
        }
        else {
            update(data, index, msg.getLength() - SmbConstants.SIGNATURE_OFFSET - 8);
        }
        byte[] signature = digest();
        for ( int i = 0; i < 8; i++ ) {
            if ( signature[ i ] != data[ offset + SmbConstants.SIGNATURE_OFFSET + i ] ) {