Hello everyone.
Two crypto changes landed in the kernel this week, and they point in two different directions: one future-proofs your traffic against a threat that hasn’t arrived yet, and one makes your Shadowsocks connection faster on every Apple device you own. Neither asks you to change your habits.
Post-Quantum Key Exchange
Every TLS handshake starts with a key exchange, and today’s exchanges are built on classical math that a large quantum computer could break. The attack has a name — harvest now, decrypt later — and it’s the reason a serious operator can’t afford to wait. An adversary recording your encrypted traffic today could decrypt it years from now, once quantum hardware catches up.
The fix is a post-quantum key exchange, and the one Chute now offers is X25519MLKEM768. It’s a hybrid: the classical X25519 exchange you already use, combined with ML-KEM-768, the key-encapsulation mechanism NIST standardized for exactly this purpose. Because it’s a hybrid, you’re protected in both worlds — if a quantum computer breaks one half, the other half still holds. And because the server can simply ignore the new group and pick X25519, nothing breaks for older servers.
There’s one condition: post-quantum exchange only activates when a policy sets a fingerprint. That’s the same switch that turns on ECH, and for the same reason — it’s what moves the handshake onto Chute’s own TLS stack, where these modern features live. Set fingerprint=chrome and you get it automatically.
AEGIS: A Faster Shadowsocks Cipher
The second change is about speed. Chute’s Shadowsocks now supports two new AEAD ciphers from the AEGIS family:
1 | aegis-128l |
AEGIS is built on the AES round function, which every modern Apple processor — iPhone, iPad, Apple TV, Mac — accelerates in hardware. On that hardware, AEGIS is markedly faster than AES-GCM or ChaCha20-Poly1305: more bytes encrypted per second, less CPU per packet. For a TUN-based proxy moving a lot of traffic, that translates directly into headroom on battery and throughput.
It’s configured like any other Shadowsocks AEAD method, with an ordinary passphrase:
1 | AEGIS = ss, 1.2.3.4, 443, aegis-128l, your-password |
One honest caveat: AEGIS is not a standard Shadowsocks cipher. No mainstream server implements it — not shadowsocks-rust, not sing-box, not Xray. It only works against a server you run yourself, built to speak it. If you’re pointing at a commercial or shared node, stick with the interoperable methods.
What This Means
These two changes are the quiet kind of security work that pays off over years, not days. Post-quantum exchange means a connection you make today isn’t retroactively decryptable tomorrow. AEGIS means the traffic you do move, on hardware you already own, moves faster. Neither requires you to do anything except — in the case of post-quantum — set a fingerprint, which you should be doing anyway.
Both are rolling out now across iOS, macOS and tvOS. Details are in the Chute Manual.
Thanks.
Chute Devs