code: private void changeReadCiphers() throws SSLException {
          if (connectionState != cs_HANDSHAKE
                  && connectionState != cs_RENEGOTIATE) {
              throw new SSLProtocolException(
                  "State error, change cipher specs");
          }
  
          // ... create decompressor
  
          CipherBox oldCipher = readCipher;
  
          try {
              readCipher = handshaker.newReadCipher();
              readMAC = handshaker.newReadMAC();
          } catch (GeneralSecurityException e) {
              // "can't happen"
              throw (SSLException)new SSLException
                                  ("Algorithm missing:  ").initCause(e);
          }
  
          /*
           * Dispose of any intermediate state in the underlying cipher.
           * For PKCS11 ciphers, this will release any attached sessions,
           * and thus make finalization faster.
           *
           * Since MAC's doFinal() is called for every SSL/TLS packet, it's
           * not necessary to do the same with MAC's.
           */
          oldCipher.dispose();
      }
docs: /*
  When a connection finishes handshaking by enabling use of a newly
  negotiated session, each end learns about it in two halves (read,
  and write).  When both read and write ciphers have changed, and the
  last handshake message has been read, the connection has joined
  (rejoined) the new session.
  
  NOTE:  The SSLv3 spec is rather unclear on the concepts here.
  Sessions don't change once they're established (including cipher
  suite and master secret) but connections can join them (and leave
  them).  They're created by handshaking, though sometime handshaking
  causes connections to join up with pre-established sessions.
  
  Synchronized on "this" from readRecord.