Security Blog
June 27, 2026 1 min read

UDP over QUIC: The Next Frontier for Circumvention BPP Blog

This is part 13 of the Black Phoenix Protocol (BPP) engineering blog series. Start with Part 00 if you are new here. The Black Phoenix Protocol, as it currently stands, operates over TCP. Like Shadowsocks, Trojan, and early V2Ray architectures, we rely on the reliability guarantees of TCP to ensure our encrypted byte streams arrive intact. But TCP is aging, and in the context of adversarial networks and heavy censorship, TCP's built-in "features" are actually vulnerabilities. The future of circumvention lies in UDP, specifically through the QUIC protocol and HTTP/3. The Problem with TCP in Hostile Networks State-controlled firewalls don't just block connections; they throttle them, inject noise, and aggressively drop packets to degrade the user experience of encrypted tunnels. When this happens over a TCP connection, we encounter Head-of-Line (HoL) Blocking . Imagine BPP is multiplexing 10 ...

Black Phoenix Protocol Series Cryptography Defensive Strategies Docker DPI Infrastructure Networking Privacy Protocol Architecture
Read Research
June 27, 2026 1 min read

The Solitary Engineer: Architecture and Mental Models BPP Blog

This is part 12 of the Black Phoenix Protocol (BPP) engineering blog series. Start with Day Zero if you are new here. Most major networking protocols TLS, QUIC, WireGuard are designed by committees (IETF) and built by large teams of dedicated engineers over years. The Black Phoenix Protocol (BPP) was designed and implemented by one person in a few months. This post isn't about code. It's about the mental models, the architectural decisions, and the psychological toll of undertaking complex, low-level systems engineering in isolation. The Mental Shift: Bytes vs. Messages The hardest part of writing a proxy protocol is unlearning high-level programming. When you write a REST API in Node.js or Python, you deal with Messages (JSON objects, HTTP requests). The language runtime handles the framing. When you write a custom protocol in Go over raw TCP sockets, there are no messages. There is only an infini...

Black Phoenix Protocol Series Cryptography Defensive Strategies Docker DPI Infrastructure Networking Privacy Protocol Architecture
Read Research
June 27, 2026 1 min read

Deploying the Phoenix: Cloud Infrastructure and OPSEC BPP Blog

This is part 11 of the Black Phoenix Protocol (BPP) engineering blog series. Start with Day Zero if you are new here. Up until now, we have focused entirely on the software: the cryptography, the Go code, the network sockets, and the Vue.js dashboard. But software doesn't run in a vacuum. A circumvention tool is only as secure as the server it runs on. In this post, we shift focus from programming to Operations Security (OPSEC) and infrastructure. How do we deploy a BPP relay node without getting it flagged, shut down, or fingerprinted by the hosting provider itself? The Illusion of the "Anonymous VPS" Many developers assume that if they pay for a Virtual Private Server (VPS) with cryptocurrency, they are anonymous. This is a dangerous misconception. Hosting providers (AWS, DigitalOcean, Hetzner, Vultr) monitor their networks. They have automated systems looking for: Continuous hig...

Black Phoenix Protocol Series Cryptography Defensive Strategies Docker DPI Infrastructure Networking Privacy Protocol Architecture
Read Research
June 27, 2026 1 min read

The AI Arms Race: Machine Learning in Deep Packet Inspection

This is part 10 of the Black Phoenix Protocol (BPP) engineering blog series. If you haven't yet, start with Day Zero . Throughout the development of BPP and our testing against BPP Guardian , we've relied on overcoming static heuristics. We bypass active probing, we spoof JA3 fingerprints, we match timing profiles, and we evade Shannon entropy thresholding by using structured, camouflage-heavy protocols (XTLS-REALITY). But the landscape of censorship is not static. State-level actors often referred to collectively as the Great Firewall (GFW) or equivalent national filtering systems are shifting their strategies. We are entering an era where Deep Packet Inspection (DPI) is being supercharged by Machine Learning (ML). This is the new arms race. Why Statistical Entropy is No Longer Enough In Part 08 , we explored Shannon entropy. Standard DPI looks for packets that are "too random" (approaching an entr...

Black Phoenix Protocol Series Cryptography Defensive Strategies Docker DPI Networking Privacy Protocol Architecture
Read Research
March 01, 2026 1 min read

uTLS: Stealing Chrome's Identity to Defeat JA3 Fingerprinting

Building Black Phoenix Protocol A Security Engineering Blog The Last Fingerprint We've spent this entire blog series making BPP traffic look like legitimate protocols. The entropy matches. The packet sizes match. The timing patterns match. Even the SNI field contains domains that belong on the host OS. By every metric we've covered, BPP traffic blends in perfectly. But there's one fingerprint we haven't addressed. And it's the one that modern DPI systems are increasingly relying on. JA3. What JA3 Is and Why It's a Problem JA3 was introduced by Salesforce in 2017 as a method to fingerprint TLS client implementations. The idea is elegant and, from an evasion perspective, terrifying. When a TLS client sends its ClientHello message, it advertises a set of capabilities: which cipher suites it suppor...

Black Phoenix Protocol Series
Read Research
March 01, 2026 1 min read

Testing the Untestable: Fuzz, Entropy, and Beating OpenVPN by 2.34x

You Can't Ship What You Can't Prove There's a particular kind of paranoia that comes from building security software. Every line of code is a potential vulnerability. Every untested edge case is a door left unlocked. And since BPP's entire value proposition is "your traffic is invisible and your data is safe," a single failure mode could be catastrophic not for our reputation, but for someone's actual freedom. So we tested. A lot. Here's how. Fuzz Testing: 500,000 Attempts to Break Each Parser Fuzz testing is the art of throwing garbage at your code and seeing what happens. Not random garbage guided garbage. Go 1.18+ has a built-in fuzzing framework ( testing.F ) that uses coverage-guided mutation: it starts with valid inputs, then systematically mutates them, guided by which code paths haven't been explored yet. ...

Black Phoenix Protocol Series
Read Research
March 01, 2026 1 min read

BPP Guardian: We Built a Firewall to Attack Ourselves

Building Black Phoenix Protocol A Security Engineering Blog The Problem with Testing Anti-Censorship Tools How do you test a protocol designed to evade state-level firewalls when you don't have access to a state-level firewall? Most anti-censorship projects rely on indirect evidence: "We deployed in China, and users report it works." That's useful but deeply unsatisfying from an engineering perspective. It tells you nothing about which heuristics are passing, nothing about edge cases, and nothing about whether the next GFW update will break everything overnight. I wanted something better. I wanted to test BPP against a DPI system that uses the same techniques as the Great Firewall, the Iranian filtering infrastructure, and Russia's TSPU but one that I control, can instrument, and can iterate against. So I built o...

Black Phoenix Protocol Series
Read Research