126.96.36.199.1 Signing the Message
The server SHOULD<182> sign the message under the following conditions:
If the request was signed by the client, the response message being sent contains a nonzero SessionId and a zero TreeId in the SMB2 header, and the session identified by SessionId has Session.SigningRequired equal to TRUE.
If the request was signed by the client, the response message being sent contains a nonzero SessionId, and a nonzero TreeId in the SMB2 header, and the session identified by SessionId has Session.SigningRequired equal to TRUE, and Share.EncryptData for the share associated with the TreeId has TreeConnect.EncryptData equal to FALSE.
If the request was signed by the client, and the response is not an interim response to an asynchronously processed request.
If Connection.Dialect belongs to the SMB 3.x dialect family, and if the response being signed is an SMB2 SESSION_SETUP Response without a status code equal to STATUS_SUCCESS in the header, the server MUST use Session.SigningKey. For all other responses being signed the server MUST provide Channel.SigningKey by looking up the Channel in Session.ChannelList, where the connection matches the Channel.Connection.
Otherwise, the server MUST use Session.SessionKey for signing the response.
The server provides the key for signing, the length of the response, and the response itself, and calculates the signature as specified in section 188.8.131.52. If the server signs the message, it MUST set the SMB2_FLAGS_SIGNED bit in the Flags field of the SMB2 header.