<p>Example implementations for these protocols can be seen in <ahref="https://github.com/tdlib/td/blob/master/td/mtproto/TcpTransport.cpp">tdlib</a> and <ahref="https://github.com/danog/MadelineProto/tree/v8/src/Stream/MTProtoTransport">MadelineProto</a>.</p>
<p>Before sending <em>anything</em> into the underlying socket (see <ahref="transports">transports</a>), the client must first send <code>0xef</code> as the first byte (the server <strong>will not</strong> send <code>0xef</code> as the first byte in the first reply).<br>
Then, payloads are wrapped in the following envelope:</p>
<li>Length: payload length, divided by four, and encoded as a single byte, only if the resulting packet length is a value between <code>0x01..0x7e</code>.</li>
<li>Payload: the MTProto payload</li>
</ul>
<p>If the packet length divided by four is bigger than or equal to 127 (>= <code>0x7f</code>), the following envelope must be used, instead:</p>
<ul>
<li>Header: A single byte of value <code>0x7f</code></li>
<li>Length: payload length, divided by four, and encoded as 3 length bytes (little endian)</li>
<p>Before sending <em>anything</em> into the underlying socket (see <ahref="transports">transports</a>), the client must first send <code>0xeeeeeeee</code> as the first int (four bytes, the server <strong>will not</strong> send <code>0xeeeeeeee</code> as the first int in the first reply).<br>
Then, payloads are wrapped in the following envelope:</p>
<p>Padded version of the <ahref="#intermediate">intermediate protocol</a>, to use with <ahref="#transport-obfuscation">obfuscation enabled</a> to <strong>bypass ISP blocks</strong>.</p>
<p>Before sending <em>anything</em> into the underlying socket (see <ahref="transports">transports</a>), the client must first send <code>0xdddddddd</code> as the first int (four bytes, the server <strong>will not</strong> send <code>0xdddddddd</code> as the first int in the first reply).<br>
Then, payloads are wrapped in the following envelope:</p>
<li>Length: length+seqno+payload+crc length encoded as 4 length bytes (little endian, the length of the length field must be included, too)</li>
<li>Seqno: the TCP sequence number for this TCP connection (different from the <ahref="https://core.telegram.org/mtproto/description#message-sequence-number-msg-seqno">MTProto sequence number</a>): the first packet sent is numbered 0, the next one 1, etc.</li>
<li>payload: MTProto payload</li>
<li>crc: 4 CRC32 bytes computed using length, sequence number, and payload together.</li>
<p>These MTProto transport protocols have support for quick acknowledgment.
In this case, the client sets the highest-order length bit in the query packet, and the server responds with a special 4 bytes as a separate packet.
They are the 32 higher-order bits of SHA256 of the encrypted portion of the packet prepended by 32 bytes from the authorization key (the same hash as computed for verifying the message key), with the most significant bit set to make clear that this is not the length of a regular server response packet; if the abridged version is used, bswap is applied to these four bytes.</p>
<p>In the event of a transport error (missing auth key, transport flood, etc.), the server may send a packet with a signed little-endian number of 4 bytes, whose <strong>absolute value</strong> contains the error code (the error itself is actually negative). </p>
<p>For example, error Code 403 corresponds to situations where the corresponding HTTP error would have been returned by the HTTP protocol.</p>
<p>Error 404 (auth key not found) is returned when the specified auth key ID cannot be found by the DC.</p>
<p>Error 429 (transport flood) is returned when too many transport connections are established to the same IP in a too short lapse of time, or if any of the <ahref="/mtproto/service_messages#simple-container">container</a>/<ahref="/mtproto/service_messages_about_messages#acknowledgment-of-receipt">service message limits</a> are reached.</p>
<p>Error 444 (invalid DC) is returned while <ahref="/mtproto/auth_key#presenting-proof-of-work-server-authentication">creating an auth key</a>, <ahref="#transport-obfuscation">connecting to an MTProxy</a> or in other contexts if an invalid DC ID is specified.</p>
<p>Transport obfuscation is required to use the <ahref="transports#websocket">websocket transports</a>.</p>
<p>Transport obfuscation to <strong>prevent ISP blocks</strong> is implemented using the following protocol, situated under the MTProto transport in the ISO/OSI stack, see the <ahref="/mtproto#recap">recap</a>; this means that the payload is first wrapped in the <ahref="/mtproto/mtproto-transports">MTProto transport envelope</a> (all transports are supported), and then obfuscated: </p>
<p>Prior to establishing the connection (and eventually sending the protocol header of a specific <ahref="/mtproto/mtproto-transports">MTProto transport</a>), a 64-byte (512-bit) <strong>random</strong> initialization payload is generated.
During the generation process, special care must be taken in order to avoid a situation where that the first int (first four bytes) of the random string are equal to one of the known protocol identifiers (see above).<br>
In particular, the first four bytes must not be equal to <code>0xdddddddd</code> (padded intermediate), <code>0xeeeeeeee</code> (intermediate), <code>POST</code>, <code>GET</code>, <code>HEAD</code>, or any of the HTTP methods that are accepted by the MTProto servers.<br>
The first byte must also not be equal to <code>0xef</code> (abridged).
Bytes <code>4-8</code> must also not be equal to <code>0x00000000</code>, since that would indicate use of the full transport with the initial TCP sequence number (0).</p>
<p>The protocol identifier, if present, must be inserted in the initialization payload at byte offset <code>56</code>: if its length is less than 4, it must be padded using the protocol identifier itself, to make its length 4 (<code>0xef</code> =><code>0xefefefef</code>): the standalone protocol identifier must be not be sent aftwerwards.</p>
<p>This protocol is also (but not exclusively) used when connecting to MTProxies: <strong>only in this case</strong>, the DC ID in a specially encoded form must also be inserted in the initialization payload at offset <code>60</code>.
The encoding simply consists of the DC ID in two-byte signed little-endian form; <code>10000</code> has to be added to the DC ID to connect to the test servers; it has to be made negative if the DC we're connecting to is a media (not CDN) DC. </p>
<p>Next, a secondary initialization payload is generated by reversing the primary initialization payload. </p>
<p>Two keys are extracted from both initialization payloads, using bytes at offsets <code>8-40</code>: the key extracted from the primary payload is used as encryption key, the key extracted from the secondary payload is used as decryption key.</p>
<p>Two IVs are extracted from both initialization payloads, using bytes at offsets <code>40-56</code>: the IV extracted from the primary payload is used as encryption IV, the IV extracted from the secondary payload is used as decryption IV.</p>
<p><strong>Only if using MTProxy</strong>, the secret is used to provide connection with the MTProxy server.
The secret is a 16-byte string, usually distributed in its hexadecimal form along with the MTProxy host and port in <ahref="/api/links#mtproxy-links">proxy deep links »</a>.</p>
<p>Often, a 17-byte version of the secret can be found: this simply indicates that the client should use a specific MTProto transport (based on the first byte, usually it's <code>0xdd</code>, to indicate that the padded intermediate protocol should be used <code>0xdddddddd</code>; however, clients should default to the padded intermediate transport whenever an additional byte in the secret is encountered).</p>
<p>The extracted encryption and decryption keys must be concatenated with the secret (the first byte of which should be ignored if it's the 17-byte version), and the SHA256 hash of such string should be used as encryption/decryption key.</p>
<p>The obtained encryption and decryption key/IV pairs must then be used with <strong>AES-256-CTR</strong> to encrypt and decrypt all outgoing and incoming payloads.<br>
The final value of the encryption/decryption counter after handling an MTProto payload must be used as IV for the next payload, until the TCP/WS connection is closed.<br>
In other words, reuse the two encryption and decryption <strong>AES-256-CTR</strong> OpenSSL instances until the connection is closed. </p>
<p>The first thing that must be encrypted using the encryption key is the initialization payload itself.
Then bytes <code>56-64</code> of the encrypted initialization payload are substituted in the original initialization payload: this is the part that contains the constant MTProto transport protocol identifier and the DC ID (<strong>only for MTProxies</strong>).</p>
<p>Example pseudocode for the generation of an MTProxy connection payload (media DC 4) using the obfuscated <ahref="#padded-intermediate">padded intermediate</a> transport.
<strong>Warning</strong>: do not use the specified proxy secret in any MTProxy exposed on the internet.</p>
