[TelegramApp]

This version of the client is using manual padding with random bytes. This isn't too bad, considering the SHA1 presence. (See #4 here: https://core.telegram.org/mtproto/auth_key)

The server now supports OAEP, although this has yet to find its way into the docs and clients. We will update. Thank you!

[tptacek]

This is a brand new application, right? Why is it built on '90s (or, worse, '70s) cryptography?

You need to publish the server-side source code for me to have any chance of making sense of this. I only see the client side of the connection in your source code, not the server response.