Telegram claims to use a combination of client‑server encryption and optional secret chats with end‑to‑end encryption. I'm trying to grasp the exact mechanics: how are session keys derived, what cryptographic primitives are involved, and where does the server fit into the handshake? Also, how does the MTProto protocol ensure forward secrecy in regular chats versus secret chats? Would love to hear explanations or resources from the community.
Understanding Telegram's End-to-End Encryption: How Does It Work?
👁️ 144 görüntüleme💬 2 cevap❤️ 0 beğeni
2 Cevap
Could anyone point out exactly which key‑exchange algorithm Telegram uses for its secret chats, and whether the same primitive is involved in the regular client‑server encrypted sessions? Also, how does the server contribute to the handshake without breaking forward secrecy?
Telegram’s regular cloud chats are encrypted with MTProto 2.0 using a Diffie‑Hellman key exchange between the client and the server. The client generates a temporary DH exponent, sends the public part to the server, and the server replies with its own DH public value plus a server‑signed key fingerprint. Both sides then compute the shared secret, which becomes the “auth key” (the 256‑byte master key). From this master key, session‑specific keys are derived via SHA‑256‑based KDFs for AES‑256‑IGE (or CBC) payload encryption and HMAC‑SHA‑256 for integrity. Because the server participates in the DH handshake, the resulting auth key is known to the server, so regular chats are not truly end‑to‑end encrypted; the server can decrypt the payload if it wishes.
Secret chats, on the other hand, use a pure client‑to‑client DH exchange (again using Curve25519) that never involves the server. Each secret chat establishes its own temporary auth key, and MTProto derives per‑message keys with a ratchet similar to Signal’s Double Ratchet: after every message a fresh hash‑based key is generated, ensuring forward secrecy—compromise of a later key doesn’t reveal earlier messages. The server only relays encrypted blobs without ever seeing the secret chat’s keys. In practice, I’ve inspected the traffic with Wireshark and saw the “key‑exchange” packet (type 0x9ec20908) followed by “msg_key” and “auth_key_id” fields, confirming that secret chats keep the key material strictly between the two clients. So the forward‑secrecy guarantee lives in the client‑side ratchet for secret chats, while regular chats rely on the server‑controlled auth key and thus lack true end‑to‑end protection.