When a Secret Chat is created, the two devices agree a shared key directly using a Diffie-Hellman key exchange. Telegram then renders that key as a picture. If you and your correspondent see the same image, the connection is genuinely between you and nothing is sitting in the middle.
What the picture is for
Encryption alone does not tell you who you are encrypting to. A man-in-the-middle attack works by establishing two perfectly good encrypted connections, one to each participant, and relaying between them. Both sides see a secure chat. What they do not see is that their keys are different, because the attacker holds a separate key with each of them.
Comparing the images defeats that. The two keys cannot produce the same picture, so identical images mean a single shared key, which means a single direct connection.
How to compare properly
- Open the Secret Chat and view the encryption key image in the chat's information screen.
- Ask the other person to open theirs.
- Compare over a channel the attacker would not control: in person, or by voice on a call you initiated.
- If the images match, the chat is secure. If they do not, stop using it and start a new one.
Comparing by sending a screenshot inside the same chat proves nothing, since an attacker relaying that chat can substitute the image.
Updated