FINDING · DEFENSE

No existing fully encrypted protocol — including Obfs4, Shadowsocks, VMess, and Obfuscated OpenSSH — simultaneously satisfies passive indistinguishability (FEP-CPFA), active-manipulation resistance (FEP-CCFA), and output-length shaping. The paper presents a novel stream-based construction that provably satisfies all three using AEAD-authenticated length blocks, an output buffer supporting arbitrary fragmentation, and a padding mechanism allowing the sender to emit exactly p output bytes on demand.

From 2023-fenske-security — Security Notions for Fully Encrypted Protocols · §2–3 · 2023 · Free and Open Communications on the Internet

Implications

When building or auditing a fully encrypted transport, verify all three properties independently: passive byte-indistinguishability, silent-drop behavior under forged ciphertexts, and the ability to emit an arbitrary output byte count without leaking a minimum-length floor.
Adopt authenticated length blocks + output buffer + padding-to-target-length as the baseline construction pattern for new FEP designs rather than bolting obfuscation onto existing AEAD stream formats.