请求加回不安全的弱加密方式

[TGSAN]

Is your feature request related to a problem? Please describe.
Shadowsocks 是非常好用的 代理软件 在，它并不一定是只能用来突破网络审查。
在一些情况中它可以作为轻量、部署简单且功能强大的内网代理。
而在这些环境下并不一定需要强加密，如 rc4-md5 加密方式性能损失非常低。

如在内网环境下可以通过 shadowsocks with rc4-md5 实现简易、高性能的跳板机连接。
这种情况下无需担心协议会被嗅探。

Describe the solution you'd like
希望加回不安全但非常高效的加密方式，或者默认隐藏这些加密方式，然后通过开关来控制这些选项是否显示（标注这些方式是不安全的、容易被嗅探的）

[database64128]

I converted #3059 to this discussion, so anyone interested can still participate and add their opinions.

The official answer to this question is here.

[SekiBetu]

@MoeGuoH

#3061
有许多设备嵌入式设备都在跑这类老旧的服务，并且在当前并不会增加当前项目维护工作量情况下（指为了更安全把代码删掉这种简单做法），原先告知加隐藏的方式是最妥当的。

Adobe、Google、Microsoft大公司了，用户以亿万计，旗下产品Flash以不安全为由说砍就砍，有许多网页至今都在跑Flash，我也对这种奇怪迷惑行为表示不解.

[xhqpp]

不赞成重新加入不安全的加密
时代需要进步
否则会变得越来越臃肿
就跟Flash和XP一样
只能被扫进历史的垃圾堆

[davendu]

哈，我还以为这已经是一个确定的问题，不需要讨论了呢。

不需要讨论就关了吧，何必再打开。

[MoeGuoH]

[sorayuki]

明明不可以神化名校的……

[SekiBetu]

其实RC4的问题也是2015年就开始提出的 https://web.archive.org/web/20160829052958/https://github.com/breakwa11/shadowsocks-rss/issues/38
2020年才有禁用的趋势，现在才开始动手而已

[SekiBetu]

可惜了，一个比我还懂加密的人竟然比外行都渴望不安全

[mzz2017]

既然都安全环境了，为什么不用ssr的plain,none？为什么不用socks5？

内网穿透需要多高性能？
aes/c20p1305/rc4-md5的benchmark你做了吗？
你的数据在哪里？

[mzz2017]

既如此，愚认为加密方式带来的影响实在太小，对么

[mzz2017]

嗯？删回复做什么

[MoeGuoH]

[mzz2017]

嗯哼？这个结果不是在意料之中吗。

首先即使是在这款老旧cpu上性能也没有下降到不能接受的地步，其次安全性和性能总是不能两全的，再者你的需求如此简单github上一堆古典密码学的proxy可以用为什么非得吊死在ss上ss的理念不在于给你满足各种feature请你思考一下ss最初的内涵和意义。

最后请你不要觉得世界与你为敌你，见谁都一股火药味，不要阴阳怪气让我很难不被你弄的想站到你的对立面。

[mzz2017]

从c20p1305换到rc4md5不过获得了25%的局部提升，这不足以违背密码学实践。

[mzz2017]

嗯哼？这个结果不是在意料之中吗。

首先即使是在这款老旧cpu上性能也没有下降到不能接受的地步，其次安全性和性能总是不能两全的，再者你的需求如此简单github上一堆古典密码学的proxy可以用为什么非得吊死在ss上ss的理念不在于给你满足各种feature请你思考一下ss最初的内涵和意义。

本来就算事实的事情，但是我不搬出来，你就不会说这句话，你信嘛，甚至你会说下面“老旧cpu....”，这些话都是预料之内的事情.而且我不谈啥理念，你也不会不知道最初这个项目的初衷，你说是吧？

最后请你不要觉得世界与你为敌你，见谁都一股火药味，不要阴阳怪气让我很难不被你弄的想站到你的对立面。

况且不要自己对坑入座，多少人是自己对坑入，而又有多少无知的人被这样钓出来？

要不要这么自信，意思是我刚说一句话你就知道我的性格了都。

我感觉到我们的对话毫无价值和意义。

你赢了好吧我投你一票，快去刷apex吧别耽误时间了。

预祝新年快乐。

[SekiBetu]

可以理解为新年了，没啥好改的，删了其认为不安全其他人用不到的协议方式，以给小白负责，提供更少更优的选择，噢这不是有苹果那味道🤭。隔壁libev等没无聊到马上删除，估计是没这种小白群体把。
不过百思不得其解的是，明明就是个PPAP的产物(SOCKS5+openssl-lib)，就是为了一键开启连接不那么裸的SOCKS5，根据自己需求自己选择相应的配置方案。而不是全部都是那种高安全加密，抛开场景讲安全需求，这不就是耍流氓。流氓耍不过就说这个是我commit，我是contributors,我有权利说yes和no,建议你直接自己fork建议你自己创轮子。草太有苹果🍎内味。

没办法，这个语气说话的人多少沾点，可不敢乱赞同你

[database64128]

@andreap- Why don't you go and ask the WireGuard team, or the OpenVPN team, to add something inherently unsecure but slightly faster on certain hardware? Let's see how they would respond to your requests.

[andreap-]

@SekiBetu
thank you for your super fast reply
Indeed I cannot see this option in the client GUI (guess it should be under server configuration). Maybe you can link me to how to enable this
besides I think this modular approach would seed up the adoption of new algorithm (with no need of alpha/nightly builds)

[SekiBetu]

@SekiBetu
thank you for your super fast reply
Indeed I cannot see this option in the client GUI (guess it should be under server configuration). Maybe you can link me to how to enable this
besides I think this modular approach would seed up the adoption of new algorithm (with no need of alpha/nightly builds)

since you don't need secure, there is no meaning to use shadowsocks, you can try this: https://openvpn.net/

[andreap-]

@andreap- Why don't you go and ask the WireGuard team, or the OpenVPN team, to add something inherently unsecure but slightly faster on certain hardware? Let's see how they would respond to your requests.

@database64128
thanks for the quick reply
I do use all of them (on different port and sometimes one inside the other, like I use OpenVPN inside shadowsocks)
So I do acknowledge there are different scenarios needing different approaches. Sometimes the firewall is very hard to drill and you need to accept a reduced bandwidth. Sometimes the firewall is not that sophisticated and it's easy to bypass, so you can take advantage of this with a lighter solution giving you a greater bandwidth

and to tell you the truth I've already asked WG team about a TCP edition (5 years ago), but they declined. Most of the public (or academic) wifi just allow TCP on port 80 or 443, so wg should be tunneled on a tcp tunnel, thus adding overhead to the devices

[andreap-]

@SekiBetu
thank you for your super fast reply
Indeed I cannot see this option in the client GUI (guess it should be under server configuration). Maybe you can link me to how to enable this
besides I think this modular approach would seed up the adoption of new algorithm (with no need of alpha/nightly builds)

since you don't need secure, there is no meaning to use shadowsocks, you can try this: https://openvpn.net/
@SekiBetu
I do use openVPN as well, but sometimes I need to tunnel it inside a shadowsocks tunnel as far as the firewall check only allows https and eventually check for a connection metric or payload that looks a regular web https connection.
So I would really appreciate if you link me the plain mode you mentioned in your previous answer. I'll try it and see in with scenarios it may be good enough

[QShen3]

虽然去掉不安全的加密方式是一种进步，但是希望类似这样的break change可以放在Major版本更新里，而不是Minor版本更新中。这样可能更符合一般用户对于软件更新的理解。而在Minor更新中可以通过隐藏选项，输出警告等多种方式提示用户，在将来的版本中该加密方式会被移除。

因为并没有人购买商业服务等，所以这只是一个建议，不是要求。

[nebulabox]

无疑是退步，一群自以为是的。
功能齐全，用户可以选择更安全的，但没有就是残疾。

[okudayukiko]

Skylake之後的x64處理器都有AES。
除非CPU太舊，否則用SSE4跑AES也已經足夠。

[ilpl]

Stream Cipher挺好的,是明文和AEAD消耗cpu中的取舍. 配合插件组合使用是不错的选择.
不安全只是相对而已,对于嗅探到TLS的网站并没有什么意义只是知道SNI而已,相对的成本可以接受.对于打游戏的人更是没有意义.

[recolic]

我们在纯墙外环境做代理服务器，或者在IPLC线路中做代理服务器，或者在内网中做代理服务器，都需要用到低安全性的简单加密方式。

一个软件本来能在场景ABCDE中运行，现在不支持场景CDE的同时也没有提高场景AB中的表现。我不认为这是个好的做法。

[recolic]

如果AES-128-GCM或者chacha20-ietf-poly1305能在大多数CPU得到比aes-128-cfb更高的性能(包含延迟和吞吐量)。那么我将支持你的观点。

[SekiBetu]

如果AES-128-GCM或者chacha20-ietf-poly1305能在大多数CPU得到比aes-128-cfb更高的性能(包含延迟和吞吐量)。那么我将支持你的观点。

要先吃得上饭再谈吃得更好

[recolic]

在我提到的几种不过墙的场景中，aes-128-cfb已经能用最高的性能满足需求。因此我不理解你提到的“吃得上饭”是指什么。

[SekiBetu]

在我提到的几种不过墙的场景中，aes-128-cfb已经能用最高的性能满足需求。因此我不理解你提到的“吃得上饭”是指什么。

https://steemit.com/cn/@v2ray/3cjiux 根据这篇性能测试结果，我的建议是，你试试看v2ray

[andreap-]

There are many CPUs that support AES, and only some old routers do not support it. In theory, AES is supported, so the new encryption method takes into account performance and security, and can completely replace the old mode.

I run OpenWRT on a Linksys WRT3200ACM....and its cpu has hardware support for very few cypers and even for those...the performance is not that faster than low security ciphers like RC5.
As mentioned by other users here: not all of the users of SS-server use it in China, many of them just use it to bypass country limitations for streming films or just to bypass the very basic firewall of the Universty or many free public wifi usually blocking UDP and all ports but 80 and 443). For instance I have at home 2 different wireguard router (one rinning as a VM the other on the router), 2 different OpvenVPN, and a SS-server. All configured on differnet ports so I can use them according to the situation.
I am sorry if I don't have a grand new x86-64 cpu I can keep always on for running a ss-server with a high security cypher (I actually have one, but the motherboard is shitty and does not support restart after powerloss...so I cannot trust it)

[PHCSJC]

我来说说为什么要用rc4-md5，因为上面还套了一层kcptun，所以用弱加密就可以，弱加密可以提升速度，至少在我的机器上实测比aes快，其实我更想要不加密。

[PragmaTwice]

不加密直接 socks5 不就完事儿了，用什么 ss

[PHCSJC]

不加密直接 socks5 不就完事儿了，用什么 ss

socks5不支持tcp fast open

[PragmaTwice]

https://github.com/PragmaTwice/v2ray-core/releases/tag/v4.44.0-rc4-md5
You guys who want the feature can use this release, or compile the v4-md5-rc4 branch from my v2ray-core fork by yourselves.

[PragmaTwice]

You guys who want the feature can use this release, or compile the v4-md5-rc4 branch from my v2ray-core fork by yourselves.

WARNING: Use the insecure encryption algorithm at your own risk.

[mendax1234]

请问aes-256-cfb加密方式为什么也不支持了？