Shadowsocks 2022

Shadowsocks 2022 is the current Shadowsocks specification: its ciphers start with 2022-blake3, with better keys and replay protection. It needs no domain or certificate and is simple, fast and light; but it has no camouflage layer, so it suits relays, exits and less restrictive networks best.

Transport	TCP / UDP
Cores	Xray, sing-box, mihomo; plus the standalone ss-rust
Domain and certificate	not needed
Common clients	nearly every client, Surge included

From the menu

• Xray: main menu 4 → 4 (Nodes) → 4 (SS2022)
• sing-box: main menu 2 → 4 → 2
• mihomo: main menu 3 → 4 → 2
• Standalone: main menu 6 (ss-rust) → 1 (Install), then 2 (Show config / SS link)

From the command line

psm node add xray ss2022 --tag my-ss --port 8388

Option	Meaning
--method	cipher; 2022-blake3-aes-128-gcm by default (16-byte key, recommended), or 2022-blake3-aes-256-gcm, 2022-blake3-chacha20-poly1305
--password	the key; a random key of the right length is generated when left out

Wrapping it in ShadowTLS (mihomo)

A mihomo SS2022 node can be wrapped in ShadowTLS v3: it first completes a TLS handshake with a real website, so it looks like ordinary HTTPS.

psm node add mihomo ss2022 --tag my-ss-stls --port 8443 \
  --shadow-tls-sni HANDSHAKE_TARGET

Pick a real TLS 1.3 website as the handshake target, not a shared site behind a CDN. ShadowTLS nodes have no standard share link: export with --format surge, or take the Clash snippet from the menu.

Export for clients

psm node export xray ss2022 my-ss                  # ss:// link
psm node export xray ss2022 my-ss --format surge   # Surge line