Login

This section only applies to versions ≤ . Only tested on 1.12.1.5875. Possibly valid until late Wrath.

Sequence diagram of the login process. The login server and world server do not have to be separate, but the client expects two separate hosts.

Login can be thought of as three separate steps for the client:

1. Entering a username/password and getting to the realm list.
2. Selecting a realm and getting to the character screen.
3. Selecting a character and getting into the world.

Each step builds upon the previous and it is possible to go backwards in the process.

The client only expects connections to two different servers:

• The Login Server (default port 3724) which handles initial login using Login Packets.
• The World Server (default port 8085) which handles the character screen and gameplay on the realm using World Packets.

Realm List

Authentication with the login server happens through a variant of the SRP6 protocol using Login Packets. This allows the client and server to prove to each other that they both know the same password without revealing what the password is to eavesdroppers. The client and server can use this shared secret to create a session key which is used for encrypting the headers of World Packets when connecting to the World Server.

Login message exchange:

1. Client asks for a login challenge by sending its build number and account name
2. Server sends SRP authentication data
3. Client sends SRP proof
4. Server accepts this proof and send its own, or reject and close the connection

When the client is accepted by the server, it can send reconnect challenges to keep connected with the same session key.

1. Client asks for a reconnection challenge with the same data as login challenge
2. Server sends a reconnection challenge (16 random bytes)
3. Client sends proof data with its own client proof
4. Server accepts or not this proof.

To check the client proof, the server has to SHA1 the concatenation of: the account name, the proof data received, the reconnection challenge and the session key. This hash should match the client proof received to be valid.

It's worth noting that, for build 4125, the client automatically disconnect after a successful login challenge and proof exchange and sends a reconnect packet right away instead of asking for the realm list.

External resources about SRP and how to implement it:

• SRP6 RFC

Character Screen

When connecting to a realm the client starts a TCP connection to the string specified in the realm list address and then:

1. The client waits for the server to send SMSG_AUTH_CHALLENGE, sending CMSG_PING every 30 seconds.
2. After receiving the SMSG_AUTH_CHALLENGE the client replies with a CMSG_AUTH_SESSION.
3. Packet headers are now (weakly) encrypted from now on.
4. The server sends a SMSG_AUTH_RESPONSE.
5. The client sends a CMSG_CHAR_ENUM.
6. The server sends a SMSG_CHAR_ENUM.

The client is now on the character screen and can:

• Create a character which will send CMSG_CHAR_CREATE and the server will respond with SMSG_CHAR_CREATE. The packet is only sent after the client has entered a name and pressed "Accept".
• Delete a character which will send CMSG_CHAR_DELETE and the server will respond with SMSG_CHAR_DELETE. The packet is only sent after the client has entered "delete" and pressed "Accept".
• Rename a character which will send CMSG_CHAR_RENAME and the server will respond with SMSG_CHAR_RENAME. The packet is only sent if the rename flag is set for the character in the SMSG_CHAR_ENUM and the client tries to login.
• Request a new character list with CMSG_CHAR_ENUM and the server will respond with SMSG_CHAR_ENUM.
• Attempt to login to the world as described below.

World

When pressing "Enter World" the client sends a CMSG_PLAYER_LOGIN and the server responds with at least:

• A SMSG_LOGIN_VERIFY_WORLD that tells the client which map to load.
• A SMSG_TUTORIAL_FLAGS.

And then a SMSG_UPDATE_OBJECT with the player. The player is now logged into the world and can move around the map.