diff --git a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/NTLMEngineImpl.java b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/NTLMEngineImpl.java
index d508ef6af..4810fc61a 100644
--- a/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/NTLMEngineImpl.java
+++ b/httpclient5/src/main/java/org/apache/hc/client5/http/impl/auth/NTLMEngineImpl.java
@@ -926,7 +926,7 @@ private boolean validateSignature( final byte[] signature, final byte[] message
             //            log.info( "SSSSS validateSignature("+seqNumber+")\n"
             //                + "  received: " + DebugUtil.dump( signature ) + "\n"
             //                + "  computed: " + DebugUtil.dump( computedSignature ) );
-            return Arrays.equals( signature, computedSignature );
+            return MessageDigest.isEqual( signature, computedSignature );
         }
 
         public byte[] signAndEncryptMessage( final byte[] cleartextMessage ) throws NTLMEngineException