resPQ#05162463 nonce:int128 server_nonce:int128 pq:string server_public_key_fingerprints:Vector long = ResPQ;Here, string pq is a representation of a natural number (in binary big endian format). This number is the product of two different odd prime numbers. Normally, pq is less than or equal to 2^63-1. The value of server_nonce is selected randomly by the server; following this step, it is known to all.
server_public_key_fingerprints is a list of public RSA key fingerprints (64 lower-order bits of SHA1 (server_public_key); the public key is represented as a bare type rsa_public_key n:string e:string = RSAPublicKey, where, as usual, n and e are numbers in big endian format serialized as strings of bytes, following which SHA1 is computed) received by the server.
All subsequent messages contain the pair (nonce, server_nonce) both in the plain-text, and the encrypted portions which makes it possible to identify a âtemporary sessionâ â one run of the key generation protocol described on this page that uses the same (nonce, server_nonce) pair. An intruder could not create a parallel session with the server with the same parameters and reuse parts of server- or client-encrypted messages for its own purposes in such a parallel session, because a different server_nonce would be selected by the server for any new âtemporary sessionâ.
+All subsequent messages contain the pair (nonce, server_nonce) both in the plain-text, and the encrypted portions which makes it possible to identify a “temporary session” — one run of the key generation protocol described on this page that uses the same (nonce, server_nonce) pair. An intruder could not create a parallel session with the server with the same parameters and reuse parts of server- or client-encrypted messages for its own purposes in such a parallel session, because a different server_nonce would be selected by the server for any new “temporary session”.
This starts a round of Diffie-Hellman key exchanges.
@@ -76,7 +76,7 @@Someone might intercept the query and replace it with their own, independently decomposing pq into factors instead of the client. The only field that it makes sense to modify is new_nonce which would be the one an intruder would have to re-generate (because an intruder cannot decrypt the encrypted data sent by the client). Since all subsequent messages are encrypted using new_nonce or contain new_nonce_hash, they will not be processed by the client (an intruder would not be able to make it look as though they had been generated by the server because they would not contain new_nonce). Therefore, this intercept will only result in the intruder's completing the authorization key generation protocol in place of the client and creating a new key (that has nothing to do with the client); however, the same effect could be achieved simply by creating a new key in one's own name.
-An alternative form of inner data (p_q_inner_data_temp_dc) is used to create temporary keys, that are only stored in the server RAM and are discarded after at most expires_in seconds. The server is free to discard its copy earlier. In all other respects the temporary key generation protocol is the same. After a temporary key is created, the client usually binds it to its principal authorisation key by means of the auth.bindTempAuthKey method, and uses it for all client-server communication until it expires; then a new temporary key is generated. Thus Perfect Forward Secrecy (PFS) in client-server communication is achieved. Read more about PFS »
An alternative form of inner data (p_q_inner_data_temp_dc) is used to create temporary keys, that are only stored in the server RAM and are discarded after at most expires_in seconds. The server is free to discard its copy earlier. In all other respects the temporary key generation protocol is the same. After a temporary key is created, the client usually binds it to its principal authorisation key by means of the auth.bindTempAuthKey method, and uses it for all client-server communication until it expires; then a new temporary key is generated. Thus Perfect Forward Secrecy (PFS) in client-server communication is achieved. Read more about PFS »
RSA_PAD(data, server_public_key) mentioned above is implemented as follows:-444 error may also be returned if a test DC ID is passed in The retry_id field is equal to zero at the time of the first attempt; otherwise, it is equal to auth_key_aux_hash from the previous failed attempt (see Item 9).
+The retry_id field is equal to zero at the time of the first attempt; otherwise, it is equal to auth_key_aux_hash from the previous failed attempt (see Item 9).
pow(g, {ab}) mod dh_prime; on the server, it is computed as pow(g_b, a) mod dh_prime, and on the client as (g_a)^b mod dh_prime.In the other case, the client goes to Item 6) generating a new b. +
In the other case, the client goes to Item 6) generating a new b.
In the first case, the client and the server have negotiated auth_key, following which they forget all other temporary data, and the client creates another encrypted session using auth_key. At the same time, server_salt is initially set to substr(new_nonce, 0, 8) XOR substr(server_nonce, 0, 8). If required, the client stores the difference between server_time received in 5) and its local time, to be able always to have a good approximation of server time which is required to generate correct message identifiers.
IMPORTANT: Apart from the conditions on the Diffie-Hellman prime dh_prime and generator g, both sides are to check that g, g_a and g_b are greater than 1 and less than dh_prime - 1. We recommend checking that g_a and g_b are between 2^{2048-64} and dh_prime - 2^{2048-64} as well.
In the examples below, the transport headers are omitted:
+In the examples below, the transport headers are omitted:
@@ -53,9 +50,9 @@ For example, for the abridged version of the transport », the…">For example, for the abridged version of the transport », the client sends
0xefas the first byte (important: only prior to the very first data packet), then the packet length is encoded with a single byte (0x01-0x7e= data length divided by 4; or0x7ffollowed by 3 bytes (little endian) divided by 4) followed by the data itself. In this case, server responses have the same structure (although the server does not send0xefas the first byte).
Sent payload (excluding transport headers/trailers):
-0000 | 00 00 00 00 00 00 00 00 00 00 00 00 58 9A 9C 64
-0010 | 14 00 00 00 F1 8E 7E BE 61 07 9B D3 CE 40 0A AA
-0020 | C0 6A 7E C0 F9 E7 0A F20000 | 00 00 00 00 00 00 00 00 00 00 00 00 DC 9D 9C 64
+0010 | 14 00 00 00 F1 8E 7E BE 36 5B 3A 12 7C 5B 59 09
+0020 | 49 0E 6C 3A EC EC 01 26Payload (de)serialization:
req_pq_multi#be7e8ef1 nonce:int128 = ResPQ;| message_id | 8, 8 | -00000000589A9C64 |
+00000000DC9D9C64 |
Exact unixtime*2^32, +(4*N) if N messages with the same message ID were already generated |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| nonce | 24, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Random number | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| message_id | 8, 8 | -0168EBF7589A9C64 |
+01902F78DC9D9C64 |
Exact unixtime*2^32, +(4*N) if N messages with the same message ID were already generated |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| message_length | 16, 4 | -7C000000 (124 in decimal) |
+54000000 (84 in decimal) |
Message body length | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| nonce | 24, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Value generated by client in Step 1 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| server_nonce | 40, 16 | -F33BCBF4A8C23D6AEE2D085D7713F5B1 |
+C2184E38BAC1649C35FD28FC20E9A7EA |
Server-generated random number | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| pq | 56, 12 | -0814E052916AAF0101000000TL byte deserialization => bigendian conversion to decimal => 1504293060055335169 |
+082535F6049213805B000000TL byte deserialization => bigendian conversion to decimal => 2681319652660052059 |
Single-byte prefix denoting length, an 8-byte string, and three bytes of padding | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| pq | 4, 12 | -0814E052916AAF0101000000TL byte deserialization => bigendian conversion to decimal => 1504293060055335169 |
+082535F6049213805B000000TL byte deserialization => bigendian conversion to decimal => 2681319652660052059 |
Single-byte prefix denoting length, 8-byte string, and three bytes of padding | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| p | 16, 8 | -043CC2C3F5000000TL byte deserialization => bigendian conversion to decimal => 1019397109 |
+045FE619EF000000TL byte deserialization => bigendian conversion to decimal => 1608915439 |
First prime cofactor: single-byte prefix denoting length, 4-byte string, and three bytes of padding | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| q | 24, 8 | -0457F4ED5D000000TL byte deserialization => bigendian conversion to decimal => 1475669341 |
+0463555C55000000TL byte deserialization => bigendian conversion to decimal => 1666538581 |
Second prime cofactor: single-byte prefix denoting length, 4-byte string, and three bytes of padding | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| nonce | 32, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Value generated by client in Step 1 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| server_nonce | 48, 16 | -F33BCBF4A8C23D6AEE2D085D7713F5B1 |
+C2184E38BAC1649C35FD28FC20E9A7EA |
Value received from server in Step 2 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| new_nonce | 64, 32 | -77C0A68BC9A69DB0E0499475DD0EED08 0BF059CA679BA9ABACB5BBCF692576FA |
+AABBEA0C7725B4A627D8E4057BC3BDA4 DFB430723091E0E20FBD94FCD0F26F24 |
Client-generated random number | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| message_id | 8, 8 | -00000000599A9C64 |
+04000000DC9D9C64 |
Exact unixtime*2^32, +(4*N) if N messages with the same message ID were already generated |
|
| nonce | 24, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Value generated by client in Step 1 | |
| server_nonce | 40, 16 | -F33BCBF4A8C23D6AEE2D085D7713F5B1 |
+C2184E38BAC1649C35FD28FC20E9A7EA |
Value received from server in Step 2 | |
| p | 56, 8 | -043CC2C3F5000000TL byte deserialization => bigendian conversion to decimal => 1019397109 |
+045FE619EF000000TL byte deserialization => bigendian conversion to decimal => 1608915439 |
First prime cofactor: single-byte prefix denoting length, 4-byte string, and three bytes of padding | |
| q | 64, 8 | -0457F4ED5D000000TL byte deserialization => bigendian conversion to decimal => 1475669341 |
+0463555C55000000TL byte deserialization => bigendian conversion to decimal => 1666538581 |
Second prime cofactor: single-byte prefix denoting length, 4-byte string, and three bytes of padding | |
| encrypted_data | 80, 260 | -FE000100CFCCD0A2FE4CE6DA364CAD61 560586C2A0481427128257864AF9BA9B 047612F7030BECC81F3A911A8A9178E2 EA0205297B3A70B9C4001273E817C289 613DC2F80033EEE5B41ED7B6C8EBB2CD AAFBB1115B800F736D0B5651FD279F13 D7E23B13365FBE0F561137D7D33A32BC D2FAEB8091FF528BEFD48EF6EAAB42BE 1201E879259EC477AD033CBD13C2C160 7F9EB61663CE372DD5E7999FC5F0CE6B 7903AE812BDDA619551BFBE69218BEC7 E550B2E5E8428C2C8AF615ACD34F53D2 5737B87280E28BB2157B34987C00C1F4 5D734D79364166BB1FA275DA0563DBE0 9EFBC03450450947196C526A580A09B2 5F4CB23786ABFB00862AE177183A9FADA88E86D3 |
+FE000100272390AE7D9BD642310E05D7 7A4C34AE44CA3790AA81FAA4D18DE327 DF7DF575105FDD874416F2E907C97AA9 7A0697D460E3824C51397675E5314196 EBF6E1E771436830844417671E295822 E1FB892DC830CEFC756EBBF592670393 0918FC0FA379B350D5C4F74C8221622C 58BD0561E898DDC1F614AE73A6D6E727 D1857361E7940A233DB206A23F7B02A1 09C0D694DF29CC9C63085A98F6C478A7 26C7D01889DB009A471C2C471530AD95 FDD7989B13D6216345314BEF01E84C8D 673786861343A9979C54DD937BFA1A1B 12C02B303EAFC9F69F16DBBED0AD5689 495B90DD2F4062562DCF7934B75F5F00 C9059005CE581DC2EE704548703E74C975EED2E4 |
See Generation of encrypted_data » |
| message_id | 8, 8 | -01647985599A9C64 |
+01F4AA18DD9D9C64 |
Exact unixtime*2^32, +(4*N) if N messages with the same message ID were already generated |
|
| message_length | 16, 4 | -E8020000 (744 in decimal) |
+84020000 (644 in decimal) |
Message body length | |
| nonce | 24, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Value generated by client in Step 1 | |
| server_nonce | 40, 16 | -F33BCBF4A8C23D6AEE2D085D7713F5B1 |
+C2184E38BAC1649C35FD28FC20E9A7EA |
Value received from server in Step 2 | |
| encrypted_answer | 56, 596 | -FE500200F1B0F8E0E234D33F9E48D871 E12FC90CE88EA536E0A561EE5463158E 72208CF790CDAD29A3316DD8F36FB94C DD119BD77B4C7A62EFBC3E6EDC4010E8 9E7208651C7262155C791F2352EBF97F C6883C59BB94033EDE006E252C46FA2F 7B0BCAC6354AF423873F705BDE51AC92 4F1B59258CDB03ABCA67AD5B2FF1847C F5DB3F0F0A65525DEAB4E0FEA2B3BDF7 CB475215CFCBBF0782144B7A09153AF9 ACB637AC8C3738977A480A1C367F1395 404340E934F64628C17CD33FE5FDCB36 2638ADC41834CEB6B43C25F8072593D2 172FB2931AE1D74D5F62493A29EC52B3 1C911956AD8B1057CEAB920BA102A70D B678A1FE5D5A7A428716F5CC063EBBEC F6776AF4AE2DD2E2BACBA28240B90E26 76B05CE27F391275104412A65E5B56FC 741B62FEA8BA1D612CF1FF83AE513226 42B62B60582584D2459C946A497225C7 55C03CA5219CFA50F900685CFD26D75E 11267FF482A3CEA1DC50FAB87E08CB91 4FA4F6583A1A69104E034DBA054670F2 2AD266FE800D872428B5165DC54D87FF E992D31B25A0E04FFC7008D7E5BE0224 30630330D365D7B28D33EC8F54D4DF5C 5ED0D9E8A17535C8A03B25F4B297D4EC 036D6AEEDF84653E63DDDEE7A2B91A0F 0C2464FE56CD63D64315F77DDF6B4429 E6C1EC7169FC1F74963154738E34DF12 01E68BD03B5D7CBCC6D7E2820C4C05B5 1AF167437E4263E243E45293246AC63C 3B7AEE5DF2956385382161C876D78122 845E70BF4A37C148E3CBEF4749FE92E6 6B9DBA10321BEAF7728189CDCE8A0D80 548FA16A369A8F6689B6E2FCE56520C4 951422F2B213D917A56FF94F4D91BB96867A8761 |
+FE500200702FF1032B5BA7264B04CD20 AA980FB82179D016274600128EC86B8E 705D09B6C9239AA697A99D0D6B9F397B 58122C49205C606290C64B67FD47AA12 5EBC7820891E117C9910984D5F824F3B 513E112E733D3A795C0C82F159364B35 9FED51E065AE464E0ADFF05E657595EF 0DDE7D28D73A86420485483CBD77ADEE 1BAFCB0002074D766AC6B7C30D4B412F E2DE9BC70EFD5DC2E7BAA4D52E96AFE6 8AFB4DE4C18E16034E1F0D1ED89307B7 324595BF8FDF834C109EA1E0B9D9D0B6 56A3B3BBB1C3FC3627FFF3DE470D22C8 375B6C7699AD67EF0F720B16F9EA695C 530D13E585A7E61290995817CB21ED22 CD74BB94218C39CBA860F6653E43BBC7 2C02A047B811CD4D6A4846EFA8D3F919 06D9056AAF890E0EF51EA3A72DFC7FB6 CE81746F1EA045CFB5714D2AE04EC012 CF9A4424CCB23CCCBB4C8482CEBF064B EE18EEAF2A43850199C74431EDBB105C 63CA66BA313784405DB0E74FDD70D0D5 E22EFD16572B790F9CE2035E51E68B82 7B1B7C8E3648E2C37FBEF24AD25D7E97 95B9183DB2C86E308B31046EE2923CC6 58122FC9024095C293F7E7F7E9596CC0 750F5586F20F856A561FA6E2FE66067C C75BA0F1A9ED76C9FEDC8B1377FBDB9C CCD02937DD8EEA2258545AAAAB6CBC77 D91D3F228741DE65AB49264B361B936D 7BE206AAD1904CA53D291448DAD1988B B2779F15F6F9E8262A7EC2690D8A194F 0A66E80C2C18901CFD811B7C2A6A07DE 5A62AC53E6BCF0679BA300C4E3501DDF C50B2E5E64695A2F38C897AD6CDF596B EBC75F57ABC5F2928D7CAEE79C2366BA 1972FE1D9895041D4D7FC8483C9646BB1EBEFB4D |
See Decomposition of encrypted_answer » |
| nonce | 4, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Value generated by client in Step 1 | |
| server_nonce | 20, 16 | -F33BCBF4A8C23D6AEE2D085D7713F5B1 |
+C2184E38BAC1649C35FD28FC20E9A7EA |
Value received from server in Step 2 | |
| g_a | 300, 260 | -FE0001002E356F542ED36C7C234A0C6D BA49CDF1B1D4510968CEF23450B0FC42 F20B63757B95D5AFC1DCA0ED8E146219 B411B0D254A7C740457F54E51C4EC8B6 B9C97B84A23EA77E36D38A4230BE5D7B 1E65BB3F0A4E6D486B22CB279703634A FE013962427A67D78C81FC74AD292FB9 70B3DFB4F00F93F0FB172B3C9069234E 2154AC2D2CD52EA2015D693CF37308D8 1F1A27B92EE69B260B056A34ADBFC649 6A419A24E2D8F54B048FCDD66AB99D0A 3CD0DA36DE726019C11750F39FF63BAC 6ADD9758286D44275535BB19B53AB57C 7C890E0DE9DA13A50DC6F3E9F3C6EBD6 37489D6968960CC9991F69B0E2E1C306 144395D303284C0C12D4376CB56BA051C060FCFF |
+FE000100AA3BB529DC2EF3C74A49AB7F 8C9A84BFE86F5CC3ACBBBB5EE047566E 5AF06CE56F10627D75F886ECD2777D16 79B87E81523BB585DC50F768C9A419C2 2C260B6924B17A8F153B9F260FC161EC E1D595380FC33CDBDF552F019FB829E0 701C005A7B849A71F9EF8C5141E01F15 2466F41BB9F13B0FEF8E0EFC3091DAF7 C4A9E4F65F77B4D3F15EC3977FFA6CB6 BAB7F995E2CE25398E09DA9EAD7AAA4B F05A9133B954080F7B258F20C0FADE9E 44A7B2AA73E51D91AC86720335CBB38A 3DB90689D85233899F292228EFB6FD28 5923760A5E220ADC3F52B3E0265BFC5A B23E4DDC2D4E14E18B2811EE656B5A16 586663289D02422C48F1B8D77017EFFCD276E5ED |
g_a diffie-hellman parameter |
|
| server_time | 560, 4 | -599A9C64 (1687984729 in decimal) |
+DD9D9C64 (1687985629 in decimal) |
Server time |
| nonce | 4, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Value generated by client in Step 1 |
| server_nonce | 20, 16 | -F33BCBF4A8C23D6AEE2D085D7713F5B1 |
+C2184E38BAC1649C35FD28FC20E9A7EA |
Value received from server in Step 2 |
| g_b | 36, 260 | -FE0001002F96BE7689D134320851F824 7F8B92A541EA353EFBE190F0B79A5445 1121A3A21B3AE5AD1F744A957804362E FFCB1199342FEB787873032801CC9B99 1349E86B9E6973A1337A67AE94A5E73B D312DD146B0659B25460A838612055B5 A5823814F3AAA8DFBD54B8094C429945 41407C11293DFC08FCEDB50665104207 ECAAC3DEE4B5AEBC1742159B39F8B00D 4CD49616F8C3AF5E50A69EBEE7B7913B 91369BD9736F9A42B4697F0DB7B11B95 A7C927DF7D72DD90A42B2B3B9D3F2281 D27454F1CFE659B33832855DD95E65EB 6CF34EAE308F7B2972016BBBDEB20C30 782B587CA16C8CDEB87A5108975A6069 BAAB97EDBBFB1E2C0B7C190142F66B4970C2D130 |
+FE0001003DE753B9F0985A68E14BD95E 3B720FCB617EB5899AA28772C8B477BA D4FA9544C671AA9D4B3E2F90ABDC55B2 5A61AD4FE5132AD3CFEDC5EA196110F4 E4F02656F57D61FCE05D660F129DD1B8 17A003F73783BA041103A199B0AAB76A 13FFFC339C35DB8A368FCBB4B35387CB 82A019886FEFB17227616BBE287818B5 553E339247890288C2DC6077FE721F76 9F92751F637E1731D1101803E522F293 D4BEB4B17FDF121FB5C23B8D0EF2B02A 0706638FD6415B5A7E90B8A55AE6CA13 E2F238BF4C7856D1406ED546D7A6A79C BCEDDBF2209C0F074502067B7A15B2AD 28EE139D2250006ECE5A2449C87F2B0E AA0B2CB75CD97D775055495DB03C7E03F9F614DF |
Single-byte prefix denoting length, a 256-byte (2048-bit) string, and zero bytes of padding |
| retry_id | 296, 8 | 0000000000000000 |
-Equal to zero at the time of the first attempt; otherwise, it is equal to auth_key_aux_hash from the previous failed attempt (see Item 7). |
+Equal to zero at the time of the first attempt; otherwise, it is equal to auth_key_aux_hash from the previous failed attempt (see Item 9). |
The serialization of Client_DH_Inner_Data produces a string data. This is used to generate encrypted_data as specified in step 6, using the following inputs:
-data = 54B6436661079BD3CE400AAAC06A7EC0F9E70AF2F33BCBF4A8C23D6AEE2D085D7713F5B10000000000000000FE0001002F96BE7689D134320851F8247F8B92A541EA353EFBE190F0B79A54451121A3A21B3AE5AD1F744A957804362EFFCB1199342FEB787873032801CC9B991349E86B9E6973A1337A67AE94A5E73BD312DD146B0659B25460A838612055B5A5823814F3AAA8DFBD54B8094C42994541407C11293DFC08FCEDB50665104207ECAAC3DEE4B5AEBC1742159B39F8B00D4CD49616F8C3AF5E50A69EBEE7B7913B91369BD9736F9A42B4697F0DB7B11B95A7C927DF7D72DD90A42B2B3B9D3F2281D27454F1CFE659B33832855DD95E65EB6CF34EAE308F7B2972016BBBDEB20C30782B587CA16C8CDEB87A5108975A6069BAAB97EDBBFB1E2C0B7C190142F66B4970C2D130
-padding = 3F278A4C4010D41218A1D70F
-tmp_aes_key = 83E6FC26B9543A3D5FE6357D7DF98DC7E5EDA4B1791A2973A414443CD6736E2B
-tmp_aes_iv = F61B20DAF8A413BCEBE132A7EE9410C958F7B1C3537E82A7C35E899F77C0A68Bdata = 54B64366365B3A127C5B5909490E6C3AECEC0126C2184E38BAC1649C35FD28FC20E9A7EA0000000000000000FE0001003DE753B9F0985A68E14BD95E3B720FCB617EB5899AA28772C8B477BAD4FA9544C671AA9D4B3E2F90ABDC55B25A61AD4FE5132AD3CFEDC5EA196110F4E4F02656F57D61FCE05D660F129DD1B817A003F73783BA041103A199B0AAB76A13FFFC339C35DB8A368FCBB4B35387CB82A019886FEFB17227616BBE287818B5553E339247890288C2DC6077FE721F769F92751F637E1731D1101803E522F293D4BEB4B17FDF121FB5C23B8D0EF2B02A0706638FD6415B5A7E90B8A55AE6CA13E2F238BF4C7856D1406ED546D7A6A79CBCEDDBF2209C0F074502067B7A15B2AD28EE139D2250006ECE5A2449C87F2B0EAA0B2CB75CD97D775055495DB03C7E03F9F614DF
+padding = 8FD908884FACC949D9DC73DE
+tmp_aes_key = 81A769A19DC0ED0D3DABE397D479407674D72119F479C1425094F54AB0188100
+tmp_aes_iv = 3C22B0B11A532C2778AEB3002E5331A7B5D59D62E0E72FA734EB7B62AABBEA0CProcess:
data_with_hash := SHA1(data) + data + padding (0-15 random bytes such that total length is divisible by 16)
encrypted_data := AES256_ige_encrypt (data_with_hash, tmp_aes_key, tmp_aes_iv);Output:
-encrypted_data = 430A36E55F18CB44BFFFAC0272BCBE6F1FCFC589D2FD35A96EF285F383800F6CBBCC0B0A576827B237A41894BFFEFA5D9C880340CBB1CD4E016BE6A089ED80C41456397EFE2791707BBBD629C5CBAE237856BCFF5D3B057A26C9FA8917B6B218B10D1B7ADB62F471AEFDA26D2678C492B569D636E38DC46B1BDE833A980C16E4A1D8E7CDE40AF26DD28E00CA34A8C01BE311550C81681B0E070CD627333E837E395980C93F69417BCA8864AECCF4211E949EA79FC3556F415E4F8C1B0454217759E8436132323A4251BBB051F17E4191C40BA003757918180EDF9537AC791C15093FED041F1FC0F0A88C39BAF6E463F1A90BAC6D7A3BE0C6195F3230DB264047341E2CB4067404FE078EB89E0745903DB1AA4BBDAB03E1DA91083D7F8D57AD0AC69948D00A380912E7F297CF86C316F7517798869B2185E9AEFADB2BDC07E2893D4B9FD06E723AC2FE0A96BD7532A424encrypted_data = 93330604E44C6F993349C60F05C23EDC56B844B57C654AEDF19B44F5EF8DB9590F7D9A9F8E81C50C377E3481D8DF9DD585D45AE25D3B9E51CE4FF584130236697C14C6BBFD65599D53132AB5FB31FF4AAC92EC7F256B5F9CE8FFB747F77E9F81588D277E3DFFB9F14E3642ACD2A1F9BBE66054608627027692D2A08DCC6671A4E6A43EFF37053E7F57DA1E04D8D6395D27BD09D7D49F46713CF0232073B342A3E2F34D23D9D8CD70E154A713B0AFACC27910ABC49D99EBA882FEBC22F6A5E7FD5AE5ABF49352372FA64D9D11BF4380197C59AEDE23D11DD7E09FABDD85A6173CD0CB8F1DFD7D0301C6DD4E40FDDC9C3A80C1E5ABDC51ADFEF357753C7B7D4DE4E8A4CAF10DF7248BCDACE125A08A35CBF4A021CFA1D78F606EE604BA14F012B13F22252C952FD52B0560679C63168188B07805E45613C7EFEE8C5495E72931C2553A0FCA7BB11D3ED48F1A5043DC776DThe length of the final string is 336 bytes.
Sent payload (excluding transport headers/trailers):
-0000 | 00 00 00 00 00 00 00 00 04 00 00 00 59 9A 9C 64
-0010 | 78 01 00 00 1F 5F 04 F5 61 07 9B D3 CE 40 0A AA
-0020 | C0 6A 7E C0 F9 E7 0A F2 F3 3B CB F4 A8 C2 3D 6A
-0030 | EE 2D 08 5D 77 13 F5 B1 FE 50 01 00 43 0A 36 E5
-0040 | 5F 18 CB 44 BF FF AC 02 72 BC BE 6F 1F CF C5 89
-0050 | D2 FD 35 A9 6E F2 85 F3 83 80 0F 6C BB CC 0B 0A
-0060 | 57 68 27 B2 37 A4 18 94 BF FE FA 5D 9C 88 03 40
-0070 | CB B1 CD 4E 01 6B E6 A0 89 ED 80 C4 14 56 39 7E
-0080 | FE 27 91 70 7B BB D6 29 C5 CB AE 23 78 56 BC FF
-0090 | 5D 3B 05 7A 26 C9 FA 89 17 B6 B2 18 B1 0D 1B 7A
-00A0 | DB 62 F4 71 AE FD A2 6D 26 78 C4 92 B5 69 D6 36
-00B0 | E3 8D C4 6B 1B DE 83 3A 98 0C 16 E4 A1 D8 E7 CD
-00C0 | E4 0A F2 6D D2 8E 00 CA 34 A8 C0 1B E3 11 55 0C
-00D0 | 81 68 1B 0E 07 0C D6 27 33 3E 83 7E 39 59 80 C9
-00E0 | 3F 69 41 7B CA 88 64 AE CC F4 21 1E 94 9E A7 9F
-00F0 | C3 55 6F 41 5E 4F 8C 1B 04 54 21 77 59 E8 43 61
-0100 | 32 32 3A 42 51 BB B0 51 F1 7E 41 91 C4 0B A0 03
-0110 | 75 79 18 18 0E DF 95 37 AC 79 1C 15 09 3F ED 04
-0120 | 1F 1F C0 F0 A8 8C 39 BA F6 E4 63 F1 A9 0B AC 6D
-0130 | 7A 3B E0 C6 19 5F 32 30 DB 26 40 47 34 1E 2C B4
-0140 | 06 74 04 FE 07 8E B8 9E 07 45 90 3D B1 AA 4B BD
-0150 | AB 03 E1 DA 91 08 3D 7F 8D 57 AD 0A C6 99 48 D0
-0160 | 0A 38 09 12 E7 F2 97 CF 86 C3 16 F7 51 77 98 86
-0170 | 9B 21 85 E9 AE FA DB 2B DC 07 E2 89 3D 4B 9F D0
-0180 | 6E 72 3A C2 FE 0A 96 BD 75 32 A4 240000 | 00 00 00 00 00 00 00 00 00 00 00 00 DD 9D 9C 64
+0010 | 78 01 00 00 1F 5F 04 F5 36 5B 3A 12 7C 5B 59 09
+0020 | 49 0E 6C 3A EC EC 01 26 C2 18 4E 38 BA C1 64 9C
+0030 | 35 FD 28 FC 20 E9 A7 EA FE 50 01 00 93 33 06 04
+0040 | E4 4C 6F 99 33 49 C6 0F 05 C2 3E DC 56 B8 44 B5
+0050 | 7C 65 4A ED F1 9B 44 F5 EF 8D B9 59 0F 7D 9A 9F
+0060 | 8E 81 C5 0C 37 7E 34 81 D8 DF 9D D5 85 D4 5A E2
+0070 | 5D 3B 9E 51 CE 4F F5 84 13 02 36 69 7C 14 C6 BB
+0080 | FD 65 59 9D 53 13 2A B5 FB 31 FF 4A AC 92 EC 7F
+0090 | 25 6B 5F 9C E8 FF B7 47 F7 7E 9F 81 58 8D 27 7E
+00A0 | 3D FF B9 F1 4E 36 42 AC D2 A1 F9 BB E6 60 54 60
+00B0 | 86 27 02 76 92 D2 A0 8D CC 66 71 A4 E6 A4 3E FF
+00C0 | 37 05 3E 7F 57 DA 1E 04 D8 D6 39 5D 27 BD 09 D7
+00D0 | D4 9F 46 71 3C F0 23 20 73 B3 42 A3 E2 F3 4D 23
+00E0 | D9 D8 CD 70 E1 54 A7 13 B0 AF AC C2 79 10 AB C4
+00F0 | 9D 99 EB A8 82 FE BC 22 F6 A5 E7 FD 5A E5 AB F4
+0100 | 93 52 37 2F A6 4D 9D 11 BF 43 80 19 7C 59 AE DE
+0110 | 23 D1 1D D7 E0 9F AB DD 85 A6 17 3C D0 CB 8F 1D
+0120 | FD 7D 03 01 C6 DD 4E 40 FD DC 9C 3A 80 C1 E5 AB
+0130 | DC 51 AD FE F3 57 75 3C 7B 7D 4D E4 E8 A4 CA F1
+0140 | 0D F7 24 8B CD AC E1 25 A0 8A 35 CB F4 A0 21 CF
+0150 | A1 D7 8F 60 6E E6 04 BA 14 F0 12 B1 3F 22 25 2C
+0160 | 95 2F D5 2B 05 60 67 9C 63 16 81 88 B0 78 05 E4
+0170 | 56 13 C7 EF EE 8C 54 95 E7 29 31 C2 55 3A 0F CA
+0180 | 7B B1 1D 3E D4 8F 1A 50 43 DC 77 6DPayload (de)serialization:
set_client_DH_params#f5045f1f nonce:int128 server_nonce:int128 encrypted_data:string = Set_client_DH_params_answer;| message_id | 8, 8 | -04000000599A9C64 |
+00000000DD9D9C64 |
Exact unixtime*2^32, +(4*N) if N messages with the same message ID were already generated |
|
| nonce | 24, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Value generated by client in Step 1 | |
| server_nonce | 40, 16 | -F33BCBF4A8C23D6AEE2D085D7713F5B1 |
+C2184E38BAC1649C35FD28FC20E9A7EA |
Value received from server in Step 2 | |
| encrypted_data | 56, 340 | -FE500100430A36E55F18CB44BFFFAC02 72BCBE6F1FCFC589D2FD35A96EF285F3 83800F6CBBCC0B0A576827B237A41894 BFFEFA5D9C880340CBB1CD4E016BE6A0 89ED80C41456397EFE2791707BBBD629 C5CBAE237856BCFF5D3B057A26C9FA89 17B6B218B10D1B7ADB62F471AEFDA26D 2678C492B569D636E38DC46B1BDE833A 980C16E4A1D8E7CDE40AF26DD28E00CA 34A8C01BE311550C81681B0E070CD627 333E837E395980C93F69417BCA8864AE CCF4211E949EA79FC3556F415E4F8C1B 0454217759E8436132323A4251BBB051 F17E4191C40BA003757918180EDF9537 AC791C15093FED041F1FC0F0A88C39BA F6E463F1A90BAC6D7A3BE0C6195F3230 DB264047341E2CB4067404FE078EB89E 0745903DB1AA4BBDAB03E1DA91083D7F 8D57AD0AC69948D00A380912E7F297CF 86C316F7517798869B2185E9AEFADB2B DC07E2893D4B9FD06E723AC2FE0A96BD7532A424 |
-Encrypted client_DH_inner_data generated previously | +FE50010093330604E44C6F993349C60F 05C23EDC56B844B57C654AEDF19B44F5 EF8DB9590F7D9A9F8E81C50C377E3481 D8DF9DD585D45AE25D3B9E51CE4FF584 130236697C14C6BBFD65599D53132AB5 FB31FF4AAC92EC7F256B5F9CE8FFB747 F77E9F81588D277E3DFFB9F14E3642AC D2A1F9BBE66054608627027692D2A08D CC6671A4E6A43EFF37053E7F57DA1E04 D8D6395D27BD09D7D49F46713CF02320 73B342A3E2F34D23D9D8CD70E154A713 B0AFACC27910ABC49D99EBA882FEBC22 F6A5E7FD5AE5ABF49352372FA64D9D11 BF4380197C59AEDE23D11DD7E09FABDD 85A6173CD0CB8F1DFD7D0301C6DD4E40 FDDC9C3A80C1E5ABDC51ADFEF357753C 7B7D4DE4E8A4CAF10DF7248BCDACE125 A08A35CBF4A021CFA1D78F606EE604BA 14F012B13F22252C952FD52B0560679C 63168188B07805E45613C7EFEE8C5495 E72931C2553A0FCA7BB11D3ED48F1A5043DC776D |
+Encrypted client_DH_inner_data generated previously, serialized as a TL byte string |
The client computes the auth_key using formula g_a^b mod dh_prime:
auth_key = 387F13DD24C48755BB0B3F4EF874E0AE86EAE3236676695D30BCC0005ECD0836F9968DAB19B362E4A2C0E0A1DDB1E0DCDA225A2571D5D911EFBE764CA97123799117B3AC18FA749F287B304156427DCECF1D4C16A2922C9727D0CF004EA075C22A37B0D901933DEFAF27A6D1D7FC57024E02E5D12ECF9D6C1ADF1E7A1B5A85284FA29B09DA5BD5ACB0DAE6580B88C026E97F2BFDCFF183C9661DFD639804B3DFB175EA755E9D9B02DA907B299C4A84B070C0A517E27F395B8ABA67C923583BF0493A27559C9716951B554669D0A33AD6E9A8D78C5EE1E89A03A177B06833B45DD60A5680E46F6B03B7C94ECAF5E7E31B3B03D28F59E237D764E80973C1F05C98auth_key = 05ACE659A2FCCFDE0B093E1FAC47A3FA50D252047AE565F40311FC448366518D7419AA9E1ACE2AAB527BAF62405988E30B8A604BA8FADFEDCB0E36A0C9DD11CEF496105F252996DDC7925D5BB0DDA956448F460AC373FAF99575CC8D477C77B90261092265F272DF7B82753DEBDC86831D36FFF971F05CD9D9E5A09088FE293F2E9BCF08A75B66A9FE01D91CD75707B8F91BEAFD541EA235CB831CCF7694DFAB9C7E1BECF60CCBF2A38C1CD413DCB9D2E109153F66693A54E5DECAB905BBF1D7434D6FCF6A7C8D5A9787DA866ACC25B9F1317D7DD34C185ADD5A90861CF592DD0B8C09F825D26FDE8F3E17AE16478BB5D7F95AE11D4F674D8D21EAF6CC67CF29The server verifies and confirms that auth_key_hash is unique: since it's unique, it replies with the following:
Received payload (excluding transport headers/trailers):
-0000 | 00 00 00 00 00 00 00 00 01 CC C6 CE 59 9A 9C 64
-0010 | 54 00 00 00 34 F7 CB 3B 61 07 9B D3 CE 40 0A AA
-0020 | C0 6A 7E C0 F9 E7 0A F2 F3 3B CB F4 A8 C2 3D 6A
-0030 | EE 2D 08 5D 77 13 F5 B1 C9 C0 EC 9D DD 5F 1A 18
-0040 | 52 51 15 70 51 A6 94 1E0000 | 00 00 00 00 00 00 00 00 01 A8 E5 65 DD 9D 9C 64
+0010 | A0 00 00 00 34 F7 CB 3B 36 5B 3A 12 7C 5B 59 09
+0020 | 49 0E 6C 3A EC EC 01 26 C2 18 4E 38 BA C1 64 9C
+0030 | 35 FD 28 FC 20 E9 A7 EA 20 6C 98 37 3F A1 E0 49
+0040 | 14 C0 9B E1 57 2B 96 3CPayload (de)serialization:
-dh_gen_ok#3bcbf734 nonce:int128 server_nonce:int128 new_nonce_hash1:int128 = Set_client_DH_params_answer;
-dh_gen_retry#46dc1fb9 nonce:int128 server_nonce:int128 new_nonce_hash2:int128 = Set_client_DH_params_answer;
-dh_gen_fail#a69dae02 nonce:int128 server_nonce:int128 new_nonce_hash3:int128 = Set_client_DH_params_answer;dh_gen_ok#3bcbf734 nonce:int128 server_nonce:int128 new_nonce_hash1:int128 = Set_client_DH_params_answer;| message_id | 8, 8 | -01CCC6CE599A9C64 |
+01A8E565DD9D9C64 |
Exact unixtime*2^32, +(4*N) if N messages with the same message ID were already generated |
| message_length | 16, 4 | -54000000 (84 in decimal) |
+A0000000 (160 in decimal) |
Message body length |
| nonce | 24, 16 | -61079BD3CE400AAAC06A7EC0F9E70AF2 |
+365B3A127C5B5909490E6C3AECEC0126 |
Value generated by client in Step 1 |
| server_nonce | 40, 16 | -F33BCBF4A8C23D6AEE2D085D7713F5B1 |
+C2184E38BAC1649C35FD28FC20E9A7EA |
Value received from server in Step 2 |
| new_nonce_hash1 | 56, 16 | -C9C0EC9DDD5F1A185251157051A6941E |
+206C98373FA1E04914C09BE1572B963C |
The 128 lower-order bits of SHA1 of the byte string derived from the new_nonce string by adding a single byte with the value of 1, 2, or 3, and followed by another 8 bytes with auth_key_aux_hash. Different values are required to prevent an intruder from changing server response dh_gen_ok into dh_gen_retry. |