diff --git a/common/protocol/headers.go b/common/protocol/headers.go
index c72e3c52e..5f1b0d9e7 100644
--- a/common/protocol/headers.go
+++ b/common/protocol/headers.go
@@ -1,6 +1,8 @@
 package protocol
 
 import (
+	"runtime"
+
 	v2net "v2ray.com/core/common/net"
 	"v2ray.com/core/common/uuid"
 )
@@ -87,3 +89,16 @@ type CommandSwitchAccount struct {
 	Level    uint32
 	ValidMin byte
 }
+
+func (v *SecurityConfig) AsSecurity() Security {
+	if v == nil {
+		return Security(SecurityType_LEGACY)
+	}
+	if v.Type == SecurityType_AUTO {
+		if runtime.GOARCH == "amd64" || runtime.GOARCH == "s390x" {
+			return Security(SecurityType_AES128_GCM)
+		}
+		return Security(SecurityType_CHACHA20_POLY1305)
+	}
+	return Security(v.Type)
+}
diff --git a/common/protocol/headers.pb.go b/common/protocol/headers.pb.go
index 08394d8a3..82d460d12 100644
--- a/common/protocol/headers.pb.go
+++ b/common/protocol/headers.pb.go
@@ -11,6 +11,7 @@ It is generated from these files:
 	v2ray.com/core/common/protocol/user.proto
 
 It has these top-level messages:
+	SecurityConfig
 	ServerEndpoint
 	User
 */
@@ -34,23 +35,26 @@ const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 type SecurityType int32
 
 const (
-	SecurityType_LEGACY            SecurityType = 0
-	SecurityType_NONE              SecurityType = 1
-	SecurityType_AES128_GCM        SecurityType = 2
-	SecurityType_CHACHA20_POLY1305 SecurityType = 3
+	SecurityType_NONE              SecurityType = 0
+	SecurityType_LEGACY            SecurityType = 1
+	SecurityType_AUTO              SecurityType = 2
+	SecurityType_AES128_GCM        SecurityType = 3
+	SecurityType_CHACHA20_POLY1305 SecurityType = 4
 )
 
 var SecurityType_name = map[int32]string{
-	0: "LEGACY",
-	1: "NONE",
-	2: "AES128_GCM",
-	3: "CHACHA20_POLY1305",
+	0: "NONE",
+	1: "LEGACY",
+	2: "AUTO",
+	3: "AES128_GCM",
+	4: "CHACHA20_POLY1305",
 }
 var SecurityType_value = map[string]int32{
-	"LEGACY":            0,
-	"NONE":              1,
-	"AES128_GCM":        2,
-	"CHACHA20_POLY1305": 3,
+	"NONE":              0,
+	"LEGACY":            1,
+	"AUTO":              2,
+	"AES128_GCM":        3,
+	"CHACHA20_POLY1305": 4,
 }
 
 func (x SecurityType) String() string {
@@ -58,24 +62,37 @@ func (x SecurityType) String() string {
 }
 func (SecurityType) EnumDescriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
+type SecurityConfig struct {
+	Type SecurityType `protobuf:"varint,1,opt,name=type,enum=v2ray.core.common.protocol.SecurityType" json:"type,omitempty"`
+}
+
+func (m *SecurityConfig) Reset()                    { *m = SecurityConfig{} }
+func (m *SecurityConfig) String() string            { return proto.CompactTextString(m) }
+func (*SecurityConfig) ProtoMessage()               {}
+func (*SecurityConfig) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
+
 func init() {
+	proto.RegisterType((*SecurityConfig)(nil), "v2ray.core.common.protocol.SecurityConfig")
 	proto.RegisterEnum("v2ray.core.common.protocol.SecurityType", SecurityType_name, SecurityType_value)
 }
 
 func init() { proto.RegisterFile("v2ray.com/core/common/protocol/headers.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 183 bytes of a gzipped FileDescriptorProto
+	// 227 bytes of a gzipped FileDescriptorProto
 	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0xe2, 0xd2, 0x29, 0x33, 0x2a, 0x4a,
 	0xac, 0xd4, 0x4b, 0xce, 0xcf, 0xd5, 0x4f, 0xce, 0x2f, 0x4a, 0xd5, 0x4f, 0xce, 0xcf, 0xcd, 0xcd,
 	0xcf, 0xd3, 0x2f, 0x28, 0xca, 0x2f, 0xc9, 0x4f, 0xce, 0xcf, 0xd1, 0xcf, 0x48, 0x4d, 0x4c, 0x49,
 	0x2d, 0x2a, 0xd6, 0x03, 0x0b, 0x08, 0x49, 0xc1, 0x54, 0x17, 0xa5, 0xea, 0x41, 0x54, 0xea, 0xc1,
-	0x54, 0x6a, 0x79, 0x73, 0xf1, 0x04, 0xa7, 0x26, 0x97, 0x16, 0x65, 0x96, 0x54, 0x86, 0x54, 0x16,
-	0xa4, 0x0a, 0x71, 0x71, 0xb1, 0xf9, 0xb8, 0xba, 0x3b, 0x3a, 0x47, 0x0a, 0x30, 0x08, 0x71, 0x70,
-	0xb1, 0xf8, 0xf9, 0xfb, 0xb9, 0x0a, 0x30, 0x0a, 0xf1, 0x71, 0x71, 0x39, 0xba, 0x06, 0x1b, 0x1a,
-	0x59, 0xc4, 0xbb, 0x3b, 0xfb, 0x0a, 0x30, 0x09, 0x89, 0x72, 0x09, 0x3a, 0x7b, 0x38, 0x3a, 0x7b,
-	0x38, 0x1a, 0x19, 0xc4, 0x07, 0xf8, 0xfb, 0x44, 0x1a, 0x1a, 0x1b, 0x98, 0x0a, 0x30, 0x3b, 0x59,
-	0x70, 0xc9, 0x25, 0xe7, 0xe7, 0xea, 0xe1, 0xb6, 0xce, 0x89, 0xc7, 0x03, 0xe2, 0xb2, 0x00, 0x90,
-	0x40, 0x14, 0x07, 0x4c, 0x3c, 0x89, 0x0d, 0xcc, 0x32, 0x06, 0x04, 0x00, 0x00, 0xff, 0xff, 0x39,
-	0x10, 0x43, 0xb4, 0xd9, 0x00, 0x00, 0x00,
+	0x54, 0x2a, 0xf9, 0x71, 0xf1, 0x05, 0xa7, 0x26, 0x97, 0x16, 0x65, 0x96, 0x54, 0x3a, 0xe7, 0xe7,
+	0xa5, 0x65, 0xa6, 0x0b, 0xd9, 0x70, 0xb1, 0x94, 0x54, 0x16, 0xa4, 0x4a, 0x30, 0x2a, 0x30, 0x6a,
+	0xf0, 0x19, 0x69, 0xe8, 0xe1, 0xd6, 0xac, 0x07, 0xd3, 0x19, 0x52, 0x59, 0x90, 0x1a, 0x04, 0xd6,
+	0xa5, 0x15, 0xca, 0xc5, 0x83, 0x2c, 0x2a, 0xc4, 0xc1, 0xc5, 0xe2, 0xe7, 0xef, 0xe7, 0x2a, 0xc0,
+	0x20, 0xc4, 0xc5, 0xc5, 0xe6, 0xe3, 0xea, 0xee, 0xe8, 0x1c, 0x29, 0xc0, 0x08, 0x12, 0x75, 0x0c,
+	0x0d, 0xf1, 0x17, 0x60, 0x12, 0xe2, 0xe3, 0xe2, 0x72, 0x74, 0x0d, 0x36, 0x34, 0xb2, 0x88, 0x77,
+	0x77, 0xf6, 0x15, 0x60, 0x16, 0x12, 0xe5, 0x12, 0x74, 0xf6, 0x70, 0x74, 0xf6, 0x70, 0x34, 0x32,
+	0x88, 0x0f, 0xf0, 0xf7, 0x89, 0x34, 0x34, 0x36, 0x30, 0x15, 0x60, 0x71, 0xb2, 0xe0, 0x92, 0x4b,
+	0xce, 0xcf, 0xc5, 0xe3, 0x16, 0x27, 0x1e, 0x0f, 0x88, 0x9f, 0x03, 0x40, 0x02, 0x51, 0x1c, 0x30,
+	0xf1, 0x24, 0x36, 0x30, 0xcb, 0x18, 0x10, 0x00, 0x00, 0xff, 0xff, 0xc4, 0x1e, 0x65, 0x93, 0x33,
+	0x01, 0x00, 0x00,
 }
diff --git a/common/protocol/headers.proto b/common/protocol/headers.proto
index a9b71d2da..b2d841cfa 100644
--- a/common/protocol/headers.proto
+++ b/common/protocol/headers.proto
@@ -6,8 +6,13 @@ option java_package = "com.v2ray.core.common.protocol";
 option java_outer_classname = "HeadersProto";
 
 enum SecurityType {
-  LEGACY = 0;
-  NONE = 1;
-  AES128_GCM = 2;
-  CHACHA20_POLY1305 = 3;
+  NONE = 0;
+  LEGACY = 1;
+  AUTO = 2;
+  AES128_GCM = 3;
+  CHACHA20_POLY1305 = 4;
+}
+
+message SecurityConfig {
+  SecurityType type = 1;
 }
diff --git a/proxy/vmess/account.go b/proxy/vmess/account.go
index 809ece58e..eaac2f30c 100644
--- a/proxy/vmess/account.go
+++ b/proxy/vmess/account.go
@@ -39,6 +39,6 @@ func (v *Account) AsAccount() (protocol.Account, error) {
 	return &InternalAccount{
 		ID:       protoId,
 		AlterIDs: protocol.NewAlterIDs(protoId, uint16(v.AlterId)),
-		Security: protocol.Security(v.Security),
+		Security: v.SecuritySettings.AsSecurity(),
 	}, nil
 }
diff --git a/proxy/vmess/account.pb.go b/proxy/vmess/account.pb.go
index f6d5bcc6e..d8170ec60 100644
--- a/proxy/vmess/account.pb.go
+++ b/proxy/vmess/account.pb.go
@@ -30,9 +30,9 @@ var _ = math.Inf
 const _ = proto.ProtoPackageIsVersion2 // please upgrade the proto package
 
 type Account struct {
-	Id       string                                  `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
-	AlterId  uint32                                  `protobuf:"varint,2,opt,name=alter_id,json=alterId" json:"alter_id,omitempty"`
-	Security v2ray_core_common_protocol.SecurityType `protobuf:"varint,3,opt,name=security,enum=v2ray.core.common.protocol.SecurityType" json:"security,omitempty"`
+	Id               string                                     `protobuf:"bytes,1,opt,name=id" json:"id,omitempty"`
+	AlterId          uint32                                     `protobuf:"varint,2,opt,name=alter_id,json=alterId" json:"alter_id,omitempty"`
+	SecuritySettings *v2ray_core_common_protocol.SecurityConfig `protobuf:"bytes,3,opt,name=security_settings,json=securitySettings" json:"security_settings,omitempty"`
 }
 
 func (m *Account) Reset()                    { *m = Account{} }
@@ -40,6 +40,13 @@ func (m *Account) String() string            { return proto.CompactTextString(m)
 func (*Account) ProtoMessage()               {}
 func (*Account) Descriptor() ([]byte, []int) { return fileDescriptor0, []int{0} }
 
+func (m *Account) GetSecuritySettings() *v2ray_core_common_protocol.SecurityConfig {
+	if m != nil {
+		return m.SecuritySettings
+	}
+	return nil
+}
+
 func init() {
 	proto.RegisterType((*Account)(nil), "v2ray.core.proxy.vmess.Account")
 }
@@ -47,19 +54,20 @@ func init() {
 func init() { proto.RegisterFile("v2ray.com/core/proxy/vmess/account.proto", fileDescriptor0) }
 
 var fileDescriptor0 = []byte{
-	// 217 bytes of a gzipped FileDescriptorProto
-	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x6c, 0x8f, 0x41, 0x4b, 0x03, 0x31,
-	0x10, 0x85, 0xd9, 0x15, 0x6d, 0x0d, 0xda, 0xc3, 0x1e, 0x64, 0xed, 0x69, 0xf1, 0x94, 0x83, 0x4c,
-	0xb0, 0xfe, 0x02, 0x8b, 0x17, 0x6f, 0xb2, 0x7a, 0xf2, 0x22, 0x71, 0x32, 0x60, 0xa0, 0xe9, 0x2c,
-	0x93, 0xb4, 0x18, 0x7f, 0xbd, 0x98, 0xed, 0x8a, 0x88, 0xc7, 0x84, 0xef, 0x7d, 0xef, 0x8d, 0xd2,
-	0xfb, 0x95, 0xd8, 0x0c, 0xc8, 0xc1, 0x20, 0x0b, 0x99, 0x41, 0xf8, 0x23, 0x9b, 0x7d, 0xa0, 0x18,
-	0x8d, 0x45, 0xe4, 0xdd, 0x36, 0xc1, 0x20, 0x9c, 0xb8, 0xb9, 0x98, 0x48, 0x21, 0x28, 0x14, 0x14,
-	0x6a, 0x79, 0xfd, 0xc7, 0x80, 0x1c, 0x02, 0x6f, 0x4d, 0x09, 0x21, 0x6f, 0xcc, 0x3b, 0x59, 0x47,
-	0x12, 0x47, 0xcb, 0xd5, 0xa7, 0x9a, 0xdd, 0x8d, 0xda, 0x66, 0xa1, 0x6a, 0xef, 0xda, 0xaa, 0xab,
-	0xf4, 0x69, 0x5f, 0x7b, 0xd7, 0x5c, 0xaa, 0xb9, 0xdd, 0x24, 0x92, 0x57, 0xef, 0xda, 0xba, 0xab,
-	0xf4, 0x79, 0x3f, 0x2b, 0xef, 0x07, 0xd7, 0xdc, 0xab, 0x79, 0x24, 0xdc, 0x89, 0x4f, 0xb9, 0x3d,
-	0xea, 0x2a, 0xbd, 0x58, 0x69, 0xf8, 0x35, 0x67, 0xac, 0x84, 0xa9, 0x12, 0x9e, 0x0e, 0xec, 0x73,
-	0x1e, 0xa8, 0xff, 0x49, 0xae, 0x6f, 0xd4, 0x12, 0x39, 0xc0, 0xff, 0x77, 0xac, 0xcf, 0x0e, 0xbb,
-	0x1e, 0xbf, 0x2d, 0x2f, 0xc7, 0xe5, 0xf3, 0xed, 0xa4, 0x38, 0x6f, 0xbf, 0x02, 0x00, 0x00, 0xff,
-	0xff, 0x9c, 0x9c, 0x82, 0x1b, 0x27, 0x01, 0x00, 0x00,
+	// 233 bytes of a gzipped FileDescriptorProto
+	0x1f, 0x8b, 0x08, 0x00, 0x00, 0x09, 0x6e, 0x88, 0x02, 0xff, 0x6c, 0xcf, 0xcf, 0x4a, 0xc3, 0x40,
+	0x10, 0x06, 0x70, 0x36, 0xa2, 0xd5, 0xf5, 0x0f, 0x9a, 0x83, 0xc4, 0x9e, 0x82, 0xa7, 0x20, 0x32,
+	0x8b, 0xf5, 0x09, 0xac, 0x27, 0x6f, 0x92, 0x1e, 0x04, 0x2f, 0x25, 0xce, 0x8e, 0x75, 0xa1, 0x9b,
+	0x29, 0xb3, 0xdb, 0x62, 0x1e, 0xc2, 0x77, 0x16, 0x37, 0x09, 0x88, 0x78, 0xdc, 0xe5, 0x9b, 0xdf,
+	0x7c, 0xa3, 0xab, 0xdd, 0x4c, 0x9a, 0x0e, 0x90, 0xbd, 0x41, 0x16, 0x32, 0x1b, 0xe1, 0xcf, 0xce,
+	0xec, 0x3c, 0x85, 0x60, 0x1a, 0x44, 0xde, 0xb6, 0x11, 0x36, 0xc2, 0x91, 0xf3, 0xcb, 0x31, 0x29,
+	0x04, 0x29, 0x05, 0x29, 0x35, 0xbd, 0xfd, 0x23, 0x20, 0x7b, 0xcf, 0xad, 0x49, 0x43, 0xc8, 0x6b,
+	0xf3, 0x41, 0x8d, 0x25, 0x09, 0xbd, 0x72, 0xfd, 0xa5, 0xf4, 0xe4, 0xa1, 0x77, 0xf3, 0x33, 0x9d,
+	0x39, 0x5b, 0xa8, 0x52, 0x55, 0x47, 0x75, 0xe6, 0x6c, 0x7e, 0xa5, 0x0f, 0x9b, 0x75, 0x24, 0x59,
+	0x3a, 0x5b, 0x64, 0xa5, 0xaa, 0x4e, 0xeb, 0x49, 0x7a, 0x3f, 0xd9, 0xfc, 0x45, 0x5f, 0x04, 0xc2,
+	0xad, 0xb8, 0xd8, 0x2d, 0x03, 0xc5, 0xe8, 0xda, 0x55, 0x28, 0xf6, 0x4a, 0x55, 0x1d, 0xcf, 0x6e,
+	0xe0, 0x57, 0xb1, 0x7e, 0x39, 0x8c, 0xcb, 0x61, 0x31, 0x0c, 0x3d, 0x72, 0xfb, 0xee, 0x56, 0xf5,
+	0xf9, 0x88, 0x2c, 0x06, 0x63, 0x7e, 0xa7, 0xa7, 0xc8, 0x1e, 0xfe, 0xbf, 0x6d, 0x7e, 0x32, 0x54,
+	0x7d, 0xfe, 0xf1, 0x5e, 0xf7, 0xd3, 0xe7, 0xdb, 0x41, 0xd2, 0xef, 0xbf, 0x03, 0x00, 0x00, 0xff,
+	0xff, 0xd1, 0x70, 0xc9, 0x65, 0x3b, 0x01, 0x00, 0x00,
 }
diff --git a/proxy/vmess/account.proto b/proxy/vmess/account.proto
index ffcecb81f..1aff63266 100644
--- a/proxy/vmess/account.proto
+++ b/proxy/vmess/account.proto
@@ -11,5 +11,5 @@ import "v2ray.com/core/common/protocol/headers.proto";
 message Account {
   string id = 1;
   uint32 alter_id = 2;
-  v2ray.core.common.protocol.SecurityType security = 3;
+  v2ray.core.common.protocol.SecurityConfig security_settings = 3;
 }
diff --git a/tools/conf/vmess.go b/tools/conf/vmess.go
index b18eec724..62e96dc4e 100644
--- a/tools/conf/vmess.go
+++ b/tools/conf/vmess.go
@@ -27,15 +27,19 @@ func (v *VMessAccount) Build() *vmess.Account {
 		st = protocol.SecurityType_AES128_GCM
 	case "chacha20-poly1305":
 		st = protocol.SecurityType_CHACHA20_POLY1305
+	case "auto":
+		st = protocol.SecurityType_AUTO
 	case "none":
 		st = protocol.SecurityType_NONE
 	default:
 		st = protocol.SecurityType_LEGACY
 	}
 	return &vmess.Account{
-		Id:       v.ID,
-		AlterId:  uint32(v.AlterIds),
-		Security: st,
+		Id:      v.ID,
+		AlterId: uint32(v.AlterIds),
+		SecuritySettings: &protocol.SecurityConfig{
+			Type: st,
+		},
 	}
 }