Trojan Protocol Security Deep Dive: Technical Implementation of TLS Camouflage and Anti-Censorship Mechanisms

1. Protocol Architecture and TLS Camouflage

The Trojan protocol's core idea is to disguise proxy traffic as standard HTTPS traffic. It operates on port 443 and uses a TLS encrypted tunnel, but unlike traditional HTTPS proxies, Trojan designs a special application-layer protocol on top of TLS. When a client initiates a connection, it first completes a standard TLS handshake, then sends a request header containing a password. If the password is correct, the server establishes a proxy tunnel; otherwise, the server returns a fake HTTP 404 response, making the connection appear as a failed web page visit.

The brilliance of this design lies in the fact that even if a man-in-the-middle can decrypt the TLS traffic (e.g., via MITM attack), they only see ordinary HTTP requests, not obvious proxy protocol signatures. Trojan does not modify the TLS handshake process, thus avoiding introducing abnormal fingerprints.

2. Anti-Deep Packet Inspection (DPI) Mechanisms

Trojan employs multiple techniques to counter DPI:

• Traffic Pattern Mimicry: Trojan's TLS handshake fully follows standard procedures, using common cipher suites (e.g., TLS_AES_256_GCM_SHA384) and avoiding uncommon extensions or curves.
• Covert Password Verification: The password field is encapsulated within the TLS encryption layer and cannot be directly observed externally. Even if an attacker attempts a replay attack, the unique TLS session key ensures replayed packets fail verification.
• Response Obfuscation: For unauthorized connections, the server returns a standard HTTP error page rather than a protocol error message, making it difficult for scanning tools to distinguish a Trojan server from a normal web server.

3. Security Limitations and Improvements

Despite Trojan's excellent anti-censorship performance, it has some limitations:

• TLS Fingerprinting: If the server uses a monotonous combination of TLS certificates or cipher suites, it may be identified by JA3/JA3S fingerprinting systems. It is recommended to use certificates issued by public CAs like Let's Encrypt and rotate them periodically.
• Traffic Behavior Analysis: Long-term stable connection patterns (e.g., data transmission at fixed intervals) may be detected by machine learning models. Traffic padding or random delays can be used to blur behavioral characteristics.
• Password Leakage Risk: Passwords are stored in plaintext in client configurations. Once leaked, attackers can fully control the proxy channel. Strong passwords and two-factor authentication are recommended.

4. Deployment Best Practices

• Certificate Management: Use automated tools (e.g., acme.sh) to obtain and auto-renew TLS certificates, avoiding self-signed certificates.
• Port Selection: Although port 443 is the default, consider using other common HTTPS ports (e.g., 8443) to reduce the probability of targeted scanning.
• Multi-User Isolation: Assign independent passwords to each user and limit connection rates to prevent abuse by a single user from affecting the overall service.

5. Conclusion

The Trojan protocol achieves significant success in countering DPI through clever TLS camouflage and traffic obfuscation. However, as detection technologies evolve, Trojan must continuously update its fingerprint library and obfuscation strategies. For users seeking high stealth, combining Trojan with WebSocket or gRPC transport layers can further enhance anti-detection capabilities.