Summary
For Shadowsocks deployment using stream ciphers, long-term key and randomly generated IV of insufficient length causes (key, IV) pair reuse with high probability, which allows Reused Key Attack. Adversaries can recover plaintext within reasonable budget constraint.
Proposal
- Stream ciphers with IV length less than 12 bytes MUST be deprecated. Namely,
bf-cfb, chacha20, and salsa20.
- Users SHOULD choose stream ciphers with IV length of 16 or more bytes.
- Users are RECOMMENDED to use the new AEAD ciphers.
Summary
For Shadowsocks deployment using stream ciphers, long-term key and randomly generated IV of insufficient length causes (key, IV) pair reuse with high probability, which allows Reused Key Attack. Adversaries can recover plaintext within reasonable budget constraint.
Proposal
bf-cfb,chacha20, andsalsa20.