Hacker News Reader

Comment by pfg | Hacker News Reader

  if the client encryption is reliable

It's not[1].

It is not, or was not? Did this issue get rectified by Telegram?

No, they still use MTProto and not an AEAD construction.

I was referring to the padding attack. Did they patch this?

And are there any property of MTProto that makes it infeasible to replace AES IGE in a later revision of the protocol?

The problem isn't IGE. It's that they're using SHA1 (not HMAC-SHA1) in a "MAC and Encrypt" construction.