Shadowsocks-2022:
The Fiber Standard
BLAKE3-based encryption designed for maximum throughput. If you have a 1Gbps+ home fiber connection on a premium route, this is the protocol that will let you use all of it.
Quick Summary — What Is This?
Think of it like this: VLESS-Reality is about stealth — disguising your traffic. Shadowsocks-2022 is about raw power. It uses BLAKE3, a hash function designed for speed, meaning your CPU spends less time encrypting and more time pushing data. On a premium CN2 GIA route with 1Gbps fiber, this protocol can saturate your connection.
What It Is
BLAKE3-based Shadowsocks optimized for raw throughput
Why It Works
Low computational overhead means near-line-speed on modern hardware
Who It's For
Users with 1Gbps+ home fiber on CN2 GIA or CMI premium routes
Why Does BLAKE3 Beat Legacy Encryption?
Shadowsocks-2022 replaced the aging stream ciphers (chacha20-ietf-poly1305) with AEAD 2022. The critical upgrade is
switching from HKDF to BLAKE3 key derivation.
BLAKE3 is a cryptographic hash function that operates at
approximately 4x the speed of SHA-256 on modern hardware,
eliminating the CPU bottleneck that plagued legacy configurations
on high-bandwidth connections.
The Trade-Off
Shadowsocks-2022 trades stealth for speed. It doesn't disguise itself as Apple.com like VLESS-Reality. The GFW can identify Shadowsocks traffic under focused scrutiny. But against passive monitoring — which is 95% of the GFW's operation — its encrypted stream with mandatory replay protection is effective.
How Does BLAKE3 Key Derivation Work?
Unlike legacy Shadowsocks where a simple text password was hashed, Shadowsocks-2022 requires a cryptographically random Pre-Shared Key (PSK). This is a 32-byte random value, base64-encoded. This eliminates the risk of brute-force attacks against weak passwords that the GFW exploited in 2023-2024.
# Generate a cryptographically secure 32-byte PSK
openssl rand -base64 32
# Example output (DO NOT USE THIS — generate your own):
# x4+eLxJv8G7mK9Z5C3rEhQ3vMT8oYkP7N6sR2wF1uXA=
# Verify key length (must be 44 characters in base64)
echo -n "YOUR_KEY" | wc -cShadowsocks-2022 includes built-in replay protection with a 120-second window. This means each packet includes a timestamp, and the server rejects any packet that's a duplicate or older than 2 minutes. This was added specifically because the GFW was recording and replaying Shadowsocks handshakes to identify servers.
How Should You Configure the Server?
The configuration below is optimized for maximum throughput on a
high-bandwidth server. Key optimizations include no_delay (disables Nagle's algorithm), reuse_port (allows kernel-level load balancing), and fast_open (TCP Fast Open for reduced latency).
{
"server": "0.0.0.0",
"server_port": 8388,
"method": "2022-blake3-aes-256-gcm",
"password": "BASE64_ENCODED_32_BYTE_PSK",
"timeout": 300,
"fast_open": true,
"mode": "tcp_and_udp",
"no_delay": true,
"keep_alive": 15,
"reuse_port": true,
"ipv6_first": false
}How Do You Tune the Kernel for Maximum Throughput?
To fully exploit a 1Gbps+ connection, the Linux kernel's default TCP buffer sizes are insufficient. BBRv3 congestion control is essential — it responds to bandwidth rather than loss, making it ideal for the packet-drop-heavy Chinese internet backbone.
# Enable BBRv3 congestion control (Linux 6.x+)
echo "net.core.default_qdisc=fq" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_congestion_control=bbr" | sudo tee -a /etc/sysctl.conf
# Optimize TCP buffer sizes for 1Gbps throughput
echo "net.core.rmem_max=67108864" | sudo tee -a /etc/sysctl.conf
echo "net.core.wmem_max=67108864" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_rmem=4096 87380 33554432" | sudo tee -a /etc/sysctl.conf
echo "net.ipv4.tcp_wmem=4096 65536 33554432" | sudo tee -a /etc/sysctl.conf
# Apply immediately
sudo sysctl -pWhat Are the Route Requirements?
⚠️ Critical: CN2 GIA Route Required
Shadowsocks-2022 is not effective on standard 163 backbone routes. The standard China Telecom backbone applies aggressive traffic shaping that limits encrypted streams to 50-100 Mbps during peak hours, regardless of protocol.
You need a VPS on the AS4809 CN2 GIA (Global Internet Access) route — this is the premium tier that bypasses the congested 163 backbone entirely. China Mobile International (CMI) premium routes are also acceptable.
| Route | Peak Throughput | SS-2022 Viable? | Notes |
|---|---|---|---|
| CN2 GIA-E (AS4809) | 800-1000 Mbps | ✓ Optimal | The gold standard. 10Gbps priority backbone. |
| CMI Premium | 500-700 Mbps | ✓ Good | China Mobile International — less congested than CT routes. |
| CU AS4837 | 300-500 Mbps | △ Marginal | Acceptable but not optimal for 1Gbps targets. |
| CT 163 Backbone | 50-100 Mbps | ✗ Avoid | Aggressive shaping during peak hours. Not viable. |