编辑“︁NetworkDesign”︁（章节）

=== 已连接状态 ===

[[Image:messages-connected.png|thumb|Messages used to securely login.]]

由于安全性要求，登录过程有点复杂。 不要害怕，只要遵循以下的步骤即可.

一旦建立了TCP连接，客户端就会使用以下命令向服务器请求RSA公钥 [https://sourceforge.net/p/arianne/marauroa/ci/master/tree/src/marauroa/common/net/message/MessageC2SLoginRequestKey.java C2SLoginRequestKey]. 服务器检查每个消息中隐式包含的协议版本. 如果兼容，它会回复一个 [https://sourceforge.net/p/arianne/marauroa/ci/master/tree/src/marauroa/common/net/message/MessageS2CLoginSendKey.java S2CLoginSendKey] 包含 RSA 公钥. 它由两个字节数组组成: 第一个包含 'n' 的值, 第二个包含 'e' 的值.

客户端计算 nonce (随机数) 并将其哈希值作为字节数组发送到服务器 [https://sourceforge.net/p/arianne/marauroa/ci/master/tree/src/marauroa/common/net/message/MessageC2SLoginSendPromise.java C2SLoginPromise] . 服务器会记住客户端的随机数，并在 [https://sourceforge.net/p/arianne/marauroa/ci/master/tree/src/marauroa/common/net/message/MessageS2CLoginSendNonce.java S2CLoginSendNonce] 回复服务器的nonce.

差不多可以了: 客户端现在拥有了实际发送消息所需的所有信息。 [https://sourceforge.net/p/arianne/marauroa/ci/master/tree/src/marauroa/common/net/message/MessageC2SLoginSendNonceNameAndPassword.java C2SLoginSendNonceNameAndPassword]: Its nonce, the username and the value rsaCrypt(xor(xor(client nonce, server nonce), password)). The first field is a bytes array containing the client nonce, the second one a string containing the username and the third one a byte array containing the encrypted password. On reception, the server checks that the hash he received at first is the hash of the nonce he just received. It then decodes the password field, and having the value of the client nonce and its nonce, it gets the value of the password.

The [https://sourceforge.net/p/arianne/marauroa/ci/master/tree/src/marauroa/common/net/message/MessageS2CLoginNACK.java S2CLoginNACK] message is sent from the server to the client to tell the client that its login request was rejected because the username or password is wrong, the account was banned or the server is full. The included result object will tell which of the cases prevented the login.

If the username/password combination, however, is correct then the Server must send a [https://sourceforge.net/p/arianne/marauroa/ci/master/tree/src/marauroa/common/net/message/MessageS2CLoginACK.java S2CLoginACK] message to tell the client that the message has been correctly processed. It contains information about the last login, so that the user is able to recognize unauthorized usage of his account. The client state is changed to "logged in" in this case.
{{br}}