How Telegram Secret Chat Encryption Works: Where Keys Live

The difference is where the key lives

Secret chat messages still pass through the server, but the server only carries a locked box. To see this difference from a user's point of view, read what secret chats protect, and what they don't and Telegram encryption explained.

How the two devices make a key

1. Your device requests a secret chat and sends its key-exchange ingredient, a Diffie-Hellman public value, through the server.
2. The other device accepts and sends its own ingredient back.
3. Each device computes the same shared key. The server only carried the ingredients, so it cannot know the key.

The principle is the same as creating the authorization key with the server; see creating an authorization key. The two people can compare an image generated from the key to confirm that no one stepped in between.

The key changes during the chat

Using one key for a long time means that if it ever leaks, more past messages can be decrypted. So the official apps switch to a new key and delete the old one once a key has been used for more than 100 messages or for more than a week. This is perfect forward secrecy. If your own app supports secret chats, it must follow the same rule.

What only secret chats have

• Tied to a device: they belong to that device's session, not to the account, so they do not appear on other devices.
• Sequence numbers block insertion and replay: each device counts the messages it has sent and received separately, so missing or resent messages are noticed.
• A one-time key per file: photos and files are encrypted with a random key separate from the chat key before upload, and only that key is sent through the chat.
• Self-destruct timer: messages can be deleted from both devices a set time after they are read.

What it does not protect against

The checks you must make if you implement this yourself are in client security guidelines, and the big picture of the protocol in MTProto at a glance.