* RFC 5246/7.4.9 says that finished messages can
* be ciphersuite-specific in both length/PRF hash
* algorithm. If we ever run across a different
* length, this call will need to be updated.
*/
TlsPrfParameterSpec spec = new TlsPrfParameterSpec(
masterKey, tlsLabel, seed, 12,
prfHashAlg, prfHashLength, prfBlockSize);
KeyGenerator kg = JsseJce.getKeyGenerator(prfAlg);
kg.init(spec);