From Shadowsocks to Trojan: Evolution and Security Assessment of Modern VPN Proxy Protocols

Introduction

As internet censorship and traffic monitoring technologies evolve, traditional VPN protocols (e.g., PPTP, L2TP/IPsec) are being phased out due to their obvious fingerprints and vulnerability to Deep Packet Inspection (DPI). New-generation proxy protocols like Shadowsocks, V2Ray, and Trojan have emerged, employing obfuscation, encryption, and masquerading to provide stable connections while evading detection. This article traces the evolution of these protocols and assesses their security.

Shadowsocks: The Pioneer of Lightweight Encrypted Proxies

Shadowsocks (SS), originally developed by Clowwindy, uses a SOCKS5 proxy architecture with symmetric encryption (e.g., AES-256-CFB) and a one-time password (OTP) mechanism. Its key advantages are lightweight design, simple configuration, and traffic patterns similar to HTTPS, which initially bypassed the Great Firewall (GFW) effectively. However, as DPI improved, SS's fixed encryption algorithms and handshake signatures became identifiable, leading to widespread server blocking.

V2Ray: Multi-Protocol Fusion and Dynamic Ports

V2Ray, the core component of Project V, supports multiple proxy protocols (e.g., VMess, Shadowsocks, Socks) and introduces dynamic ports, traffic obfuscation (e.g., WebSocket+TLS), and routing rules. The VMess protocol uses UUIDs for user identification and timestamp verification to prevent replay attacks. V2Ray's flexibility allows it to adapt to complex network environments, but its configuration is complex, and VMess still has certain fingerprint features, such as fixed header lengths.

Trojan: Masquerading as HTTPS Traffic

Trojan's design philosophy is to "masquerade as normal HTTPS traffic." It directly uses TLS encryption and encapsulates proxy traffic within HTTP/1.1 GET or POST requests, making the traffic nearly indistinguishable from regular web browsing. Trojan does not introduce additional encryption layers, relying instead on TLS for encryption and integrity, resulting in low performance overhead. Its main strength is difficulty for DPI to identify, as the traffic looks like standard HTTPS. However, Trojan's weakness lies in potential blocking if TLS certificates are tampered with or server IPs are heavily monitored.

Security Assessment and Comparison

| Protocol | Encryption | Anti-Detection | Performance | Configuration Complexity | |----------|------------|----------------|-------------|--------------------------| | Shadowsocks | Symmetric | Medium (DPI-prone) | High | Low | | V2Ray (VMess) | Custom+TLS | High (obfuscatable) | Medium | High | | Trojan | TLS | Very High (HTTPS mimicry) | High | Medium |

From a security perspective, Trojan excels in anti-detection but depends on TLS strength; V2Ray offers the richest features at the cost of complexity; Shadowsocks remains popular for its simplicity but requires obfuscation plugins (e.g., v2ray-plugin) to enhance security.

Future Trends

Future proxy protocols will emphasize "featurelessness," such as using QUIC (UDP-based TLS) or WireGuard. Meanwhile, machine learning-driven DPI is advancing, requiring protocol developers to continuously update obfuscation strategies. Users should consider network environment, performance needs, and security levels when choosing a protocol.