static byte[] ntlm2SessionResponse(final byte[] ntlmHash, final byte[] challenge,
            final byte[] clientChallenge) throws NTLMEngineException {
        try {
            final MessageDigest md5 = getMD5();
            md5.update(challenge);
            md5.update(clientChallenge);
            final byte[] digest = md5.digest();

            final byte[] sessionHash = new byte[8];
            System.arraycopy(digest, 0, sessionHash, 0, 8);
            return lmResponse(ntlmHash, sessionHash);
        } catch (final Exception e) {
            if (e instanceof NTLMEngineException) {
                throw (NTLMEngineException) e;
            }
            throw new NTLMEngineException(e.getMessage(), e);
        }
    }
Calculates the NTLM2 Session Response for the given challenge, using the
specified password and client challenge.

@return The NTLM2 Session Response. This is placed in the NTLM response
        field of the Type 3 message; the LM response field contains the
        client challenge, null-padded to 24 bytes.
httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/NTLMEngineImpl.java