SSLSession.getAppBufferSize is Huge. Do we have to use it?

Question

SSLSession.getAppBufferSize and SSLSession.getPacketBuffer size are both 16K. Breaking this down to
1. 16K for incoming encrypted packet buffer
2. 16K for outgoing encrypted packet buffer
3. 16K for incoming packet data
4. I only have 2K for outgoing packet data since I know my packets are not larger than 2000.
This seems huge resulting in 3 Megabytes of memory for 100 connections to my server. Do I have to use an app buffer size of 16K?
I can understand having to use packet buffer size of what it says for the handshake, but I don't get having to use a big app buffer size.
Also, why is the packet buffer size so huge. The biggest handshake message i saw in my case was 1.2K, not even close to 16K. What is going on and how can I trim these numbers down?
thanks,
dean

Answer 1

The SSLEngine doesn't know what's at the other end of the wire and it has to be able to decrypt the maximum SSL message payload which is a touch over 16k depending to a certain extent on cipher suites. You can use less if you know what you are doing at both ends. OTOH 16k isn't so much these days, I would have worried about in 1976 or even 1986 and maybe 1994 but not since.