sun.security.ssl.HandshakeMessage::digestKey checks if a method named "implUpdate(SecretKey)" is defined in the implementation class of MessageDigestSpi in a MessageDigest instance; if so, it invokes that method.

sun.security.pkcs11.P11Digest seems to be the only class defining "implUpdate(SecretKey)" method with the following comment:

235 // Called by SunJSSE via reflection during the SSL 3.0 handshake if
236 // the master secret is sensitive. We may want to consider making this
237 // method public in a future release.
238 protected void implUpdate(SecretKey key) throws InvalidKeyException {

P11Digest is a final class and looks like this method does not need to be protected.

One option to replace the reflection call with an internal interface defining the implUpdate method signature. HandshakeMessage can check if MessageDigestSpi instance is such interface and invoke the method statically.