Security Analysis of the Telegram IM

### Telegram Architecture and the Roll-Your-Own Crypto Dilemma At 00:00, Tomas Susanka opens with an evaluation of Telegram, an instant messaging platform boasting hundreds of millions of users that promotes itself as a fast and secure communication tool. Susanka highlights the immediate red flag raised by the cryptographic community: rather than adopting established, peer-reviewed primitives like TLS or the Signal Protocol, Telegram engineered its own proprietary transport and end-to-end protocol dubbed MTProto.

### Default Cloud Chats vs. Opt-In Secret Chats At 03:15, Susanka distinguishes between Telegram's default "Cloud Chats" and its optional "Secret Chats." In standard cloud chats, messages are encrypted only between client and server using MTProto; plaintext message histories, media, and encryption keys reside directly on Telegram's cloud servers. Only "Secret Chats" provide true end-to-end encryption (E2EE) where keys remain solely on endpoints, but this mode must be manually initiated and does not synchronize across multiple user devices.

### Cryptographic Anatomy of MTProto 1.0 At 07:22 and 10:37, the presentation dissects the cryptographic building blocks of MTProto 1.0. Susanka critiques Telegram's idiosyncratic design choices, including the pairing of SHA-1 hashing with non-standard AES in Infinite Garble Extension (IGE) mode. He demonstrates that MTProto lacks modern authenticated encryption (AEAD) primitives like AES-GCM or ChaCha20-Poly1305. By computing message authentication over plaintext rather than ciphertext, MTProto fails to achieve IND-CCA (indistinguishability under chosen-ciphertext attack) security.

### Practical Vulnerabilities and Replay Attacks At 14:08 and 17:30, Susanka outlines practical attack scenarios against the MTProto protocol. He reviews how subtle implementation flaws allow active network adversaries to manipulate message padding, stage replay attacks, and observe timing side channels. Furthermore, he points out that Telegram's phone-number-based authentication leaves users vulnerable to SS7 cellular intercept attacks and SMS hijacking, which bypass client-side protections unless two-step verification is enabled.

### Security Recommendations and Protocol Evolution Concluding around 20:04, Susanka evaluates subsequent updates (including MTProto 2.0) that phased out SHA-1 in favor of SHA-256 and improved MAC validation. Nonetheless, he warns security-conscious individuals against relying on non-standard cryptographic designs, advising users requiring provable end-to-end privacy to utilize fully open, mathematically audited messaging platforms.

(AI summary — Gemini 3.8 Flash)