This policy describes the 2.0.x implementation. Report suspected vulnerabilities in any version privately; use 2.0.x for the fixes described below.
TgCryptoRust provides AES-256 block primitives and IGE, CTR, and CBC modes. It does not implement MTProto sessions, key exchange, TL schemas, or TDLib's API. Adding schema constructors would not authenticate ciphertext or make these primitives a complete Telegram client.
Version 2.0.0 replaces the custom secret-indexed AES S-box key expansion and software T tables with RustCrypto AES. The dependency selects hardware AES on supported CPUs or its constant-time fixsliced software implementation. This removes those table-based cache-timing paths; it is not a formal security audit or a guarantee against every hardware or application side channel.
Expanded AES schedules and owned temporary key copies are zeroized when dropped.
The library cannot erase caller-owned Python bytes, all compiler/register
copies, returned plaintext, swap, or crash dumps. Keep key lifetimes short and
protect process memory in the application.
Python bytearray arguments are snapshotted before native processing. Mutable
IV/state and data retain buffer exports that prevent resizing during processing
and CTR state write-back. Small key snapshots use fixed-size arrays; after a key
has been copied, its caller-owned buffer need not remain exported.
Do not share a stream object or mutable CTR IV/state between unsynchronized
operations. Exports do not prevent another thread overwriting existing bytes.
- IGE and CBC require block-aligned input; padding is the caller's responsibility.
- CTR accepts any length and carries a big-endian 128-bit counter plus a byte offset. Never reuse a key/counter keystream for different plaintext. The low-level API preserves TgCrypto's counter wrap semantics; callers must ensure a stream cannot exhaust its counter space.
- These modes provide no standalone integrity or authenticity. Verify MTProto message keys, padding rules, session/message identifiers, and replay/time checks at the protocol layer. Do not expose unauthenticated plaintext.
- Use separate encryption/decryption stream objects initialized with the proper direction-specific key and IV. Do not mix directions on an IGE state.
- Telegram CDN transport, Passport data, and MTProto messages have different derivation and validation rules; an AES key must come from the correct one.
Reference specifications and implementation:
- MTProto 2.0 description
- Telegram CDN encryption
- Telegram Passport encryption
- TDLib AES modes
- NIST SP 800-38A mode vectors
- RustCrypto AES
Tests cover published AES/CBC/CTR known-answer vectors, an independently generated OpenSSL AES-256-IGE vector, streaming boundaries, counter carries, parallel chunk boundaries, and mutable Python buffer ownership. The Python suite has 27 tests and the Rust core has 21 unit tests plus 5 mode integration tests. Passing them establishes these specific behaviors, not complete MTProto or TDLib interoperability.
Report suspected vulnerabilities privately through GitHub's repository security advisories when available. Avoid publishing keys, tokens, or exploitable details in a public issue before maintainers can assess the report.
Release artifacts are built from a version-matched tag after CI checks. The release workflow publishes the tested artifact set; PyPI uses GitHub trusted publishing rather than a package token stored in this repository. Keep TLS, package signature/checksum checks, and platform protections enabled when installing. A clean dependency advisory scan does not replace reviewing the cipher modes and their integration with a complete Telegram client.