Home/ Questions/Q 192787
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T16:27:18+00:00

I’m doing something in Java SE that would require me to use SSL in

  • 0

I’m doing something in Java SE that would require me to use SSL in an unusual way.
The required steps would be something like:

  • Establish an SSL session;
  • Exchange some private information;
  • Renegotiate connection parameters to stop using cryptographic operations.

I haven’t found in the Java API a way to to this. I believe that the problem solution would somehow be addressed by using the session renegotiation but with a cipher suite with no cryptographic operations, but there isn’t such an option; or to access the underling socket and bypass cryptographic operations.

Are any of these options possible? Do you believe that such functionality would be available in other languages and frameworks (C, PHP, Ruby, .NET, Perl, Python, etc.)?

Thanks for the help,
Luís M. Costa

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You could do something like this in Java, but it’s definitely not standard. I can’t vouch for other platforms having the necessary support for this.

    The JSSE provides support for transport-independent SSL with the SSLEngine. You could use this to temporarily “decorate” a socket with SSL, then turn it off when you are done and use the raw socket IO directly.

    I can’t guess why you’d want to turn off SSL once you had gone to the expense of negotiating the SSL session. If it is for the sake of performance, you can renegotiate the cipher suite to use “NULL” confidentiality and integrity protocols, as long as both parties allow it. You’d still have a little overhead in the SSL record layer. However, the overhead of SSL after the session parameters have been negotiated is extremely low. If your application is that sensitive to this overhead, you might want to consider dedicated SSL hardware.

    • 0