BTP's wire protocol contains no handshakes, timeouts, or plaintext headers. Connections open with a pseudo-random b-byte tag that the recipient can compute in advance from its key state, making BTP frames indistinguishable from random data to a passive observer who does not know the shared secret.

The paper explicitly flags that BTP's fixed-size b-byte connection tag creates an active-probing oracle: a censor that sends b−1 bytes and observes no close, then sends one more byte and observes a close, can confirm the endpoint is running BTP. Preventing such active-probing attacks is identified as future work.

§8 detection

BTP's forward secrecy guarantee depends on reliably destroying old keys, but the paper notes that secure deletion from persistent storage—especially solid-state storage—is difficult with current operating systems and hardware. The recommended mitigation is passphrase-derived encryption of stored secrets, though this shifts the problem to passphrase protection.

§6.3 defense

BTP achieves forward secrecy over unidirectional transports—where ephemeral in-band key exchange is impossible—by using a one-way key derivation function (NIST SP 800-108) to produce sequential temporary secrets from an initial shared secret. Once both devices destroy a given temporary secret, no keys derived from it can be reconstructed even if devices are later compromised.

§2, §5.2–5.3 defense

BTP's secret retention period for transport t is Rt + 2C + Lt, where Rt is the rotation period, C is the maximum clock-skew tolerance, and Lt is the maximum transport latency. With Rt = 2C + Lt only two temporary secrets need simultaneous storage. Concrete durations: TCP with automatic clocks (C=10s, Lt=60s) requires 2 minutes 40 seconds; TCP with manual clocks (C=1800s) requires 4 hours 2 minutes; mail with manual clocks (Lt=2 weeks) requires 4 weeks 4 hours.

§5.3, §6.2 defense

The GFW's passive classifier uses two features of the first data packet to flag probable Shadowsocks traffic: (1) high Shannon entropy (per-byte entropy > ~7 bits strongly correlates with replay probability, which is nearly 4x higher at entropy 7.2 than at 3.0) and (2) packet length in the range 160–700 bytes with specific remainders mod 16. A single data packet after the TCP handshake is sufficient to trigger the downstream active-probing pipeline.

2020-alice-shadowsocks-detection §4.2 dpirandom-payload-detecttraffic-shape

Obfsproxy3 and obfsproxy4 are reliably detected by an entropy-distribution test (KS test, block size k=8) applied to the first 2,048 bytes of the first client-to-server packet, combined with a minimum payload-length check of 149 bytes. On three university campus datasets totaling over 14 million TCP flows, the test achieves TPR=1.0 with FPR ranging from 0.24% to 0.33%. Omitting the length check raises the SSL/TLS false-positive rate to approximately 23%.

2015-wang-seeing §5.1, Table 5 dpirandom-payload-detecttraffic-shape

Censors responding to encryption-based circumvention have two escalation options: block all encrypted connections outright, or identify the underlying protocol via traffic signatures that persist even inside encrypted tunnels. The paper frames these as the two dominant censor responses to DPI being defeated by encryption.

2011-wright-fine-grained §3 dpirandom-payload-detecttraffic-shape

A three-stage detection pipeline exploiting the "dual-role" behavioral fingerprint of single-IP circumvention relays achieved 23.2% recall (96/414 ground-truth relays) with a 0.18% false-positive rate against 97,651 benign TLS servers, for an overall accuracy of 99.5%. The ground-truth set covered OpenVPN, WireGuard, and SOCKS relays identified in a 17 TB single-day backbone trace (WIDE Project, April 9, 2025).

2026-almutairi-server §3.4, Table 1 traffic-shapedpiflow-correlation

The paper identifies a fundamental architectural vulnerability in single-IP circumvention designs: a relay must generate new observable flows (via DNS or TLS SNI) to reach end services after receiving client connections, creating a detectable server-and-client behavioral contrast. A relay accessing user-facing domains (news, social media) scores high on a Relay Suspicion Score (w=0.9) versus infrastructure domains (w=0.1). The paper argues this host-level signal is censorship-invariant and cannot be concealed by link obfuscation.

2026-almutairi-server §2.4, §4 traffic-shapedpisni-blocking

AnyTLS's default padding scheme operates across 8 levels (stop=8), with initial padding fixed at 30 bytes, small-data padding 100–400 bytes, and medium-to-large data padding chains of 400–500 bytes continuing through multiple 500–1000 byte segments. The 'c' (continue) marker allows multi-stage padding sequences within a single connection burst.

2026-anon-anytls-anytls-sing-box-2026 §2.3 traffic-shapedpi