public void writeCredentials(DataOutputStream dos, DataInputStream dis, Properties p_credentials,
      boolean isNotification, DistributedMember member, HeapDataOutputStream heapdos)
      throws IOException, GemFireSecurityException {

    if (p_credentials == null) {
      // No credentials indicator
      heapdos.writeByte(CREDENTIALS_NONE);
      heapdos.flush();
      dos.write(heapdos.toByteArray());
      dos.flush();
      return;
    }

    if (!encryptor.isEnabled()) {
      // Normal credentials without encryption indicator
      heapdos.writeByte(CREDENTIALS_NORMAL);
      DataSerializer.writeProperties(p_credentials, heapdos);
      heapdos.flush();
      dos.write(heapdos.toByteArray());
      dos.flush();
      return;
    }

    byte acceptanceCode = encryptor.writeEncryptedCredentials(dos, dis, p_credentials, heapdos);
    if (acceptanceCode != REPLY_OK && acceptanceCode != REPLY_AUTH_NOT_REQUIRED) {
      // Ignore the useless data
      dis.readByte();
      dis.readInt();
      if (!isNotification) {
        DataSerializer.readByteArray(dis);
      }
      readMessage(dis, dos, acceptanceCode, member);
    }
    dos.flush();
  }
This assumes that authentication is the last piece of info in handshake
geode-core/src/main/java/org/apache/geode/internal/cache/tier/sockets/Handshake.java