Iran's Surveillance Architecture & Telegram Tracking Crisis: auth_key_id Exposure Risk and User Defense Guide

In Iran, the moment you open a Telegram chat, your device has already handed its identity card to the surveillance system.

This is not alarmist – it stems from a design feature of Telegram's underlying MTProto encryption protocol called "auth_key_id" (authorization key identifier). In May 2026, a technical assessment report published by independent cybersecurity firm Symbolic Software confirmed that Telegram clients transmit MTProto messages over unencrypted TCP connections, causing auth_key_id to be exposed in plaintext in network traffic. Any entity with passive network access can easily extract this identifier.

This article combines Iran's unique surveillance architecture to analyze the specific risks of auth_key_id exposure, evaluates the effectiveness of various VPNs and proxies, and finally provides a practical defense plan for users.

I. Iran's Systematic Surveillance Architecture: From Shahkar to SIAM

The core advantage of Iran's surveillance system lies in its integration of network layer, mobile network layer, and identity authentication layer. Even if you successfully connect to a proxy server, the surveillance system can still identify you and your device through multiple means, and Telegram's auth_key_id exposure provides these systems with an additional, precise identifier.

1. National Information Network and Legal Intercept System (LIS)

Iran has built the National Information Network (NIN), which separates domestic internet from the international internet. Authorities have shifted from a "blacklist" blocking model to a "whitelist" model, using SHAHKAR and HAMTA databases to track users' identity documents and devices, easily cutting off public access to the international internet while reserving privileged access for specific groups.

On top of this architecture, Iran's Communications Regulatory Authority, in cooperation with the largest domestic operator, has established the Legal Intercept System (LIS), which mainly includes four subsystems: Legal Interception (LI), Illegal Device Control (CID), SHAHKAR system, and SHAMSA system. Among them:

• SHAHKAR system: A central authentication database storing information of all mobile users. SIM card registration requires biometric registration and national ID card. The system verifies whether the user using a specific IP address or phone number is a real individual.
• SIAM system: A computer system capable of remotely manipulating mobile connections, providing operators with about 40 functions to change, disrupt, and monitor users' phone usage, including forced downgrade to insecure 2G networks, location tracking, metadata collection, etc.
• Deep Packet Inspection (DPI): The surveillance system can analyze packet content and traffic characteristics, identifying VPN protocol signatures, abnormal encryption patterns, non-standard ports, and IP addresses pointing to data centers.

2. How the Surveillance Chain Works

Once your device generates traffic, the surveillance system collects information from multiple layers: DPI devices analyze network traffic in real time, identify protocols, and extract metadata; the SIAM system can obtain phone numbers and IMSI from the mobile network layer; the SHAHKAR database binds SIM cards to real identities. When these systems associate with auth_key_id, a complete identity anchoring chain is formed. The scariest part of Iran's system is not individual technical capabilities, but this cross-layer integrated architecture: Shahkar links SIM cards to national IDs, SIAM can manipulate devices, HAMTA registers device models – combined, auth_key_id becomes the final key to unlock this door.

II. auth_key_id Exposure: The Final Key in the Surveillance Chain

1. What is auth_key_id?

auth_key_id is a 64-bit identifier in the MTProto protocol. When a Telegram client first logs into a device, it generates a 2048-bit authorization key (auth_key) through Diffie-Hellman key exchange, and auth_key_id is the lower 64-bit SHA-1 hash of that key. It sits at the very front of the MTProto outer header in every message transmission, indicating to the server "which key to use to decrypt the following content."

2. Severity of Exposure

Symbolic Software's technical assessment confirms: auth_key_id remains unchanged across sessions, IP changes, network switches, and geographic moves, making it a powerful tool for passive network observers to track a single device long-term. Any network intermediary – ISP, network administrator, government surveillance system – can collect auth_key_id values through passive network monitoring, without man-in-the-middle attacks, certificate cracking, or protocol manipulation. Simple packet capture and de-obfuscation suffice.

3. Abuse Paths in Iran's Surveillance System

Facing Iran's multi-layered surveillance system, auth_key_id faces multiple exposure risks. Whether using direct connection or VPN, it may leak at several key nodes:

Surveillance Layer	Technical Mechanism	Exposure Risk
Network Layer (DPI)	ISP analyzes packets via DPI devices	Even if VPN encrypts content, auth_key_id as an application-layer identifier may be extracted; if Telegram uses unencrypted TCP, it's completely exposed.
Mobile Network Layer (SIAM)	SIAM can force downgrade to insecure 2G, collect metadata	Records auth_key_id and links it with IMSI/phone number, locking identity precisely to a personal device.
Identity Layer (Shahkar)	SIM card bound to national ID, can target specific numbers	If a certain connection (e.g., hotel WiFi login) associates auth_key_id with your real identity, the surveillance system can use Shahkar to trace all your past auth_key_id connection records.
Physical Layer (IMSI catcher)	Deploys fake base stations at protest sites	Captures phone IMSI, device model, and auth_key_id simultaneously, forming a complete device identity profile.
Passive Retrospection	Operators keep long-term logs	Once an identity anchor links to auth_key_id, the surveillance system can search historical logs to reconstruct communication patterns and behavior traces over months or even years.

4. Nature of the Risk

The risk of auth_key_id exposure lies in its persistence and linkability. It's not a session-level temporary marker, but a fixed identifier tied to the device's long-term authorization key. If a single connection (e.g., registering on hotel WiFi) associates your auth_key_id with your real identity, the surveillance system can use this "anchor" to search all historical traffic logs – your communication records from the past several months across different networks could be traced at once, even if you used a VPN or changed networks at the time.

III. Assessment of VPNs and Proxies in Iran

1. Traditional VPNs: Systematically Blocked

• OpenVPN: Protocol fingerprints fully recognized by DPI systems, blocked in Iran for many years, detection rate near 100%.
• WireGuard: Handshake process has a fixed structure, Iran's DPI systems have been trained to recognize it. A newly deployed WireGuard server is typically identified and blocked within hours. Adding obfuscation layers provides short-lived improvement, but the obfuscation itself gradually forms a fingerprint that can be classified by the system.
• IPSec/L2TP: Virtually "dead" in Iran, also massively blocked due to obvious protocol fingerprints.

Conclusion: Relying on these protocols to self-build VPN servers from scratch is no longer a sustainable solution.

2. Shadowsocks: Slightly Better than Traditional VPNs, but Not Long-term

Shadowsocks was originally created by Chinese developers to bypass the "Great Firewall," using non-standard obfuscation methods. DPI systems cannot clearly classify its traffic as proxy/VPN, giving it a relative advantage in Iran's censorship environment. But Shadowsocks is not a panacea. It lacks simulation of advanced features like TLS handshakes, and after long-term use, its traffic patterns may be classified and recognized by machine learning systems.

3. VLESS + Reality: Currently the Strongest Anti-Censorship Technology

The VLESS protocol is designed specifically to evade DPI detection, wrapping routing information in standard TLS, making the generated traffic at packet level indistinguishable from ordinary HTTPS connections. With REALITY transport technology, it can borrow legitimate websites' TLS certificates to mask the real target. Iran's active probing systems, when probing a VLESS+Reality server, receive the same response as a genuine website, and the server does not reveal its proxy function. Operators who correctly configure VLESS servers inside Iran report detection rates below 5%. A server that would be blocked within days under WireGuard standards can run for months under correct VLESS+Reality configuration.

4. MTProto Proxy: Designed Specifically for Telegram

MTProto proxy is designed specifically for Telegram and works only for Telegram; it cannot proxy browser or other app traffic. In the 2026 censorship environment, only third-generation MTProto proxies starting with "ee" (enabling Fake TLS) remain effective.

However, even Fake TLS MTProto proxies cannot hide auth_key_id. Telegram clients use unencrypted TCP at the transport layer, and auth_key_id exposure is a fundamental design issue of the protocol – no matter how much the proxy obfuscates, auth_key_id is exposed to network intermediate nodes before reaching the proxy server. On April 1, 2026, multiple Russian ISPs began selectively identifying Telegram MTProto/FakeTLS handshakes via TLS fingerprint analysis, causing widespread failure of many MTProto proxies, while VLESS Reality services on the same servers continued working normally.

IV. Feasible Solutions: Multi-layer Defense Strategy

Facing Iran's comprehensive surveillance, no single tool is sufficient to guarantee absolute security. You need a multi-layer defense strategy.

Layer	Strategy	Implementation Points
Layer 1: Anti-censorship Proxy	Use VLESS + Reality protocol	Deploy with Xray-core or Sing-box, choose proper disguise domain (e.g., api.github.com, update.microsoft.com), enable REALITY, preferably with P2P decentralized routing.
Layer 2: Telegram-specific Channel	Third-gen MTProto proxy (Fake TLS)	Use ee-prefix secret, port 443, with reputable disguise domain; as Telegram inbound channel. Note: MTProto proxy works only for Telegram and cannot solve auth_key_id exposure.
Layer 3: Periodic auth_key_id Reset	Regularly reset authorization key, stop long-term tracking (mandatory core)	Most thorough: Go to Telegram Settings → Devices, terminate all suspicious sessions; use official logout and login to generate a brand new auth_key_id. Using PFS cannot prevent identifier exposure but can limit traceability period. Perform reset every 1-3 months to greatly reduce long-term tracking risk.
Layer 4: Identity Isolation	Strictly separate real identity from sensitive communication	Do not use the same Telegram account for sensitive activities on authenticated networks (hotel WiFi, corporate network). For sensitive communication, use Tor or a trusted overseas VPS tunnel. Avoid registering sensitive accounts with SIM-linked phone numbers.
Layer 5: Multi-layer VPN/Proxy Chain	Combine anti-censorship protocols	Pass Telegram traffic first through MTProto proxy (ee Fake TLS) then wrap inside VLESS tunnel, so auth_key_id is protected by multiple encryption layers throughout transmission.
Layer 6: Decentralized P2P Network	Avoid single point dependency	Using a decentralized P2P network prevents complete service outage if a single IP gets blocked.

V. Practical Operation Guide

1. Actively Reset auth_key_id (Core Step)

Since auth_key_id's persistence is the biggest risk, periodic resetting is the most effective way to break long-term tracking.

• Logout and login again in the app: Settings → Edit Profile (iOS) or tap account avatar (Android), choose "Log Out". This is the most direct way to trigger auth_key reset.
• Remotely log out suspicious devices: On a trusted device, go to Settings → Devices, select and terminate sessions not under your control, immediately invalidating auth_key on those devices.

2. Deploy Anti-censorship Proxy

Recommended to deploy VLESS + Reality protocol on a VPS. Using Xray as an example, brief steps:

• Install Xray-core: bash -c "$(curl -L https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install
• Generate Reality keypair: xray x25519
• Configure config.json, choose a trusted disguise domain (recommend Microsoft or GitHub domains), avoid common disguise domains already flagged by surveillance systems.
• Import configuration on client (v2rayNG, Nekoray, etc.) and use chrome or safari fingerprint options.

3. Build Telegram-specific Channel

• Obtain usable third-generation MTProto proxy nodes (tg://proxy?secret=ee... format).
• Open Telegram Settings → Data and Storage → Proxy Settings → Add Proxy, select MTProto type, fill in proxy details.
• Important reminder: MTProto proxy is only for Telegram's "connection reachability"; it does not solve auth_key_id exposure. You still need to periodically reset auth_key_id.

VI. Summary and Recommendations

Under Iran's current surveillance architecture, auth_key_id exposure constitutes a significant and persistent privacy risk. Key conclusions:

• Surveillance threat is comprehensive. DPI, SIAM, and Shahkar systems cooperate, and auth_key_id exposure layered on top creates high-precision long-term device tracking capability.
• Traditional VPNs are failing. In 2026, OpenVPN and WireGuard can no longer work stably long-term in Iran; the censorship system is upgrading across the board.
• Currently effective technologies are VLESS+Reality and third-generation MTProto proxies. But MTProto proxies cannot solve the fundamental problem of auth_key_id exposure.
• Active, periodic auth_key_id reset is mandatory. Users should develop the habit of "logout → login again" every 1-3 months to break the long-term tracking chain.
• A multi-layer defense strategy is essential. In Iran, you cannot rely on a single tool; you must comprehensively use anti-censorship proxies, periodic key resets, and identity isolation to build multi-layer protection.
• The cat-and-mouse game continues. Stay vigilant and keep your defense methods updated – that's the best way to protect your safety and privacy.