Init Protocol

The init protocol begins after a successful hello handshake. Its packet IDs are unencrypted and have no checksum. See Network Protocols for shared packet conventions.

Client packet	ID	Payload size	Payload / effect
INIT_LOGIN	14	1 byte	Credentials type: 1 or 2 for encoded username and password; 3 for email and password. Creates login state and changes the channel to the login protocol.
INIT_JS5	15	4 bytes	A four-byte version/CRC value is read but currently ignored. Changes the channel to JS5.
SIGNUP_VALIDATE	16	Variable byte	RSA/XTEA-protected validation fields; see Signup packets.
SIGNUP_SUBMIT	18	Variable short	Applet settings followed by an RSA/XTEA-protected signup payload; see Signup packets.

Login initialization

The one-byte INIT_LOGIN payload selects the credential representation for the next stage. The server creates a random 64-bit nonce, switches to the login protocol, and sends this nine-byte acknowledgement:

Size	Field
1	Status (0 means init succeeded)
8	Nonce

The nonce is required in the subsequent encrypted login payload.

JS5 initialization

The INIT_JS5 request includes a four-byte version/CRC value, which is not validated. The server switches to JS5, where frames are six bytes long, and replies with a single status byte 0.

Signup packets

Both signup payloads use the same RSA/XTEA envelope as the login protocol: a two-byte encrypted-block length and that many RSA ciphertext bytes. After RSA decryption, the block contains a magic byte (10), four XTEA key integers, a two-byte plaintext length, and an XTEA-encrypted payload padded to an eight-byte boundary.

SIGNUP_VALIDATE's decrypted payload is:

Field	Encoding
Nonce	8-byte integer (read but not checked here)
Display name	JStr2
Email	JStr2

Nonblank names and emails are checked asynchronously and produce signup reply packets. Current implementation caveat: the email availability check passes the display name as the value to check, rather than the email field.

SIGNUP_SUBMIT begins with an unencrypted JStr applet-settings value, followed by the encrypted block. Its decrypted payload is:

Field	Encoding
Nonce	8-byte integer
Display name	JStr2
Email	JStr2
Password	JStr2
Affiliate ID	2-byte unsigned integer
Age	1 byte
Newsletter	1 byte

The server checks the password length (5–20 characters) and display-name length (1–12 characters), then submits the signup asynchronously. The parsed nonce, affiliate ID, age, newsletter, and applet settings do not otherwise affect signup processing.

Signup server packet types are:

Server packet	ID	Payload size	Payload
ERROR	2	Variable-any	Error as JStr
EMAIL_VALIDATION	99	1 byte	Boolean availability result
DISPLAY_NAME_UNAVAILABLE	100	Variable short	Empty payload
DISPLAY_NAME_AVAILABLE	255	Variable byte	Available name as JStr2
SIGNUP_BLOCKED	248	0	Empty payload
SIGNUP_SUCCESS	255	Variable byte	Empty unless a cookie is supplied

IDs 255 are shared by the display-name-available and signup-success replies. Not every listed reply is sent in the current implementation.