Telegram End-to-End Video Calls Architecture: Diffie-Hellman Key Exchange, 4-Emoji Verification Hash & Picture-in-Picture Multitasking
Face-to-face video calling demands rigorous cryptographic confidentiality. In Telegram, every one-on-one video call is protected by hardware-accelerated End-to-End Encryption (E2EE) based on MTProto 2.0 Diffie-Hellman key exchange. To make cryptographic verification accessible without reading 64-character hexadecimal keys, Telegram hashes the shared master secret into four recognizable emojis displayed on both callers' screens. Combined with native Picture-in-Picture multitasking and IP address privacy controls, it delivers enterprise-grade security with consumer elegance.
Watch: Initiating E2EE Video Calls & Verifying Emoji Hashes
Official demonstration from Telegram Tips (#193) showing one-on-one video call initialization, camera toggling, Picture-in-Picture multitasking, and 4-emoji verification.
key 1. Cryptographic Key Exchange & The 4-Emoji Hash
When Alice initiates a video call to Bob, Telegram's cloud servers act strictly as a signaling relay. They never hold the private encryption keys:
If a malicious entity or rogue server attempts a Man-in-the-Middle (MitM) attack by generating separate keys for Alice and Bob, the mathematical fingerprints will diverge completely. By simply asking your partner "Do you see a fox, lightning, Saturn, and diamond?", you achieve 100% mathematical certainty that no intermediary is intercepting your call.
Compare the caller and receiver screens below. Toggle between Legitimate Secure Call and Simulate MitM Interception to observe how the cryptographic emoji hash prevents eavesdropping.
cell_tower 2. P2P Direct UDP vs. Encrypted Cloud Relays
During WebRTC ICE negotiation, Telegram attempts direct Peer-to-Peer UDP communication. While P2P reduces latency to sub-50ms, it reveals your public IP address to the person on the other end of the line:
| Connection Transport | Audio/Video Latency | IP Address Privacy Guarantee | Configuration Recommendation |
|---|---|---|---|
| Peer-to-Peer (P2P) | < 50ms (Direct UDP) | Peer can observe your public IP in network packet headers. | Safe for trusted family members, personal friends, and verified coworkers. |
| Cloud Relay (TURN) | 80 – 140ms (Datacenter Bounce) | 100% Shielded; peer only sees Telegram relay IP. | Mandatory for anonymous accounts, public journalists, and unknown business contacts. |
picture_in_picture 3. Native OS Picture-in-Picture Multitasking
Unlike older video call software that locks your entire smartphone display, Telegram binds to platform PiP subsystems:
- iOS Integration: Utilizes
AVPictureInPictureControllerto render video frames on a floating system window above iOS SpringBoard and other apps. - Android Integration: Invokes
enterPictureInPictureMode()with dynamic aspect ratio parameters matching the remote caller's camera orientation. - Hardware GPU Acceleration: Video decoding runs directly on hardware decoders (Apple VideoToolbox / Android MediaCodec), keeping CPU usage below 4% and preventing device overheating.
checklist 4. Step-by-Step Operator Blueprint
How to execute secure video calls and protect your network IP:
Starting and Verifying Video Calls
- Open any 1-on-1 contact profile and tap the Video icon.
- Once connected, look at the 4 Emojis displayed in the top right corner of the screen.
- Verbally verify that your partner sees the identical 4 symbols.
- Tap the back arrow to minimize into a floating Picture-in-Picture window while reviewing documents or chatting.
Configuring IP Address Privacy
Navigate to Settings > Privacy and Security > Calls > Peer-to-Peer. Change the setting from Everybody to My Contacts or Never. Forcing cloud relays guarantees that your physical home or cellular IP address is never revealed to anonymous callers.
Telegram Video Calls Architecture at a Glance
A comprehensive visual flowchart summarizing Diffie-Hellman key derivation, the 4-emoji verification hash, P2P vs TURN relay topologies, and PiP multitasking.
