Telegram messenger's original encryption scheme, MTProto 1.0, has been shunned by most cryptographers for a number of reasons, like being vulnerable to IND-CCA attack; being unorthodox in general, making unusual applications of hashing and key generation/exchange protocols; and not having been created by someone credited by infosec community. Although it has never been actually broken, organizations like EFF do not recommend it for privacy concerned users.

Last year Telegram rolled version 2.0 of MTProto, which changed SHA1 for SHA 256, among other specifications, and is now safe against IND-CCA. Are these changes enough to redeem Telegram's reputation? Do they make it a valuable choice for safe messaging (at least in the secret chat/e2e mode) or does it still needs more improvement (if it's even possible)?

  • 3
    $\begingroup$ Are you sure MTProto 2.0 is now secure against IND-CCA? I don't see any related proof. $\endgroup$
    – Shan Chen
    Jun 20, 2018 at 1:15
  • $\begingroup$ My guess would be yes but not enough to make a difference . $\endgroup$
    – user103271
    Aug 9, 2022 at 6:12
  • 2
    $\begingroup$ mtpsym.github.io $\endgroup$ Aug 9, 2022 at 20:26


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.