--- title: "Your TLS Stack Is Lying to You About Zero-Copy" url: https://daily.dev/posts/your-tls-stack-is-lying-to-you-about-zero-copy-vp5cztfwz source_url: https://foojay.io/today/your-tls-stack-is-lying-about-zero-copy type: article source: "Foojay.io" published: 2026-06-10T12:10:21.883Z updated: 2026-06-10T12:10:57.865Z tags: ["java", "cryptography"] reading_time: 9 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your TLS Stack Is Lying to You About Zero-Copy **[Foojay.io](https://daily.dev/sources/foojayio)** · 9 min read · 0 upvotes · 0 comments ## Summary A deep dive into why SSLEngine becomes an architectural mismatch in a zero-allocation JVM runtime (the Exeris Kernel). The author explains how SSLEngine's heap-facing ByteBuffer contract undermines off-heap ownership semantics, then shows an alternative using Java's Project Panama FFM (Foreign Function & Memory) API to call OpenSSL natively. JMH benchmarks compare four TLS architectures: JDK SSLEngine (~905k ops/s, 2528 B/op allocation), Netty tcnative (~856k ops/s, 560 B/op), Exeris FFM Memory BIO (~922k ops/s, 0 B/op), and Exeris FFM FD Owner (~367k ops/s, 0 B/op). The key finding is that SSLEngine allocates over 2.5KB of heap garbage per 1KB TLS record, silently undermining a zero-allocation hot path. The author acknowledges SSLEngine remains the right choice for most Java services, but argues that for a runtime with strict off-heap ownership and deterministic cleanup requirements, native FFM-based TLS is architecturally necessary. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Welcome to Panama](https://daily.dev/posts/welcome-to-panama-pskhtfrqs) · SoftwareMill · 0 upvotes · 0 comments --- Tags: [#java](https://daily.dev/tags/java), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/your-tls-stack-is-lying-to-you-about-zero-copy-vp5cztfwz)