>In a normal PitM, the server negotiates two separate Diffie-Hellman sessions with Alice and Bob, who end up with different shared keys, which they could detect

>In a normal PitM, the server negotiates two separate Diffie-Hellman sessions with Alice and Bob, who end up with different shared keys, which they could detect by comparing fingerprints. I think that normally A and B would compare whatever they were using for long term identity and not the shared key they got from a DH exchange. So that would be the fingerprint of some sort of public key from some signature scheme. There is a tendency to throw away the results of the DH exchange as part of a forward secrecy scheme and the users would not want to have to compare fingerprints constantly. Does Telegram do something different? Edit: Sort of answering my own question. Apparently each secret chat is self contained. You are supposed to verify your fingerprints when you start one. If you start another one you then would have to check the fingerprint again. This suggests that Telegram secret chats are indefinite and can stick around for a long time. I guess that is one way to simplify identity management. That also suggests that the forward secrecy is per secret chat session. It only kicks in when you end the secret chat.