Will the use of predictable passwords lead to predictable packets?

Hi, author of Cloak here.

I have always advised my users that they do not need to enable traffic encryption in Cloak if the underlying proxy does a sufficiently good job in making their traffic appear random (disregarding side-channel behaviours such as packet timings). Shadowsocks was used as the primary example for this use case: https://github.com/cbeuw/Cloak/issues/144. Information which Cloak uses to establish and maintain its connections are always encrypted, regardless of traffic encryption settings.

However, recently a user had issues with Shadowsocks+Cloak being detected. Two things were done which fixed it: 1. Changing Cloak's handshake signature from Chrome to Firefox, and 2. Enabling Cloak's own encryption of Shadowsocks' traffic. Shadowsocks was using chacha20-poly1305 but the password was set to "testing".

I know this isn't a very good sample, as two variables were changed at once. It's well possible that the browser signature exposed Cloak, as this has happened with my Iranian users early this year: the signature for Chrome 68, which Cloak uses, appears to have been completely blocked (even with a real Chrome 68), though Firefox's signature remain unaffected. But I think it's unlikely to be the case here, as I have since updated the signature to align with a fairly recent version of Chrome.

The other possibility would be due to the weak password in Shadowsocks' configuration. Of course, if Shadowsocks were exposed to the internet, the weak password would make it trivially detectable via active probing, but that wasn't the case here as it was listening on loopback. So I'm worried that the censor might have been able to identify Shadowsocks' traffic as one configured with a common password. I'm completely unfamiliar with Shadowsocks' protocol so I'm seeking advice here. Does Shadowsocks commence a key exchange prior to validating the password which could be sent encrypted, or is the password used to seed a potentially predictable or deterministic shared secret? If it were the latter case, then I'll need to change some of Cloak's behaviours.

Thanks in advance

Start by reviewing the Shadowsocks protocol documentation and the referenced Cloak issue #144, focusing on password-derived keys, key exchange, and traffic encryption. The work is done when the protocol's effect on packet predictability and detectability is established and the findings are documented for Cloak users.