Specify recommended exchange message

[lgrahl]

In order to reduce the amount of isle solutions, I want to specify a recommended way to exchange the server's URL, initiator's permanent public key and authentication token.

While doing that, I'm also thinking about changing the path slightly to be explicit in case we add #83 at some point.

This is what I have in mind:

<scheme>://<server-address>:<server-port>/<type>/<initiator-permanent-public-key-hex>#<authentication-token-hex>

where <type> can only be 1to1 at the moment. An example:

wss://server.saltyrtc.org:4567/1to1/11c7bd3878424481db3026a6f82ecdae0daee0881c7dceec4ef38e7f5d270495#23b722be1c95832398c4122ab42d562bb27ccc20754af0b448e75fc129166564

Implementations can then extract the initiator's permanent public key and the authentication token from the path. It MUST strip everything that follows # away and can then use the result to connect to the SaltyRTC server.

Using # before the authentication token also will help in case an implementation forgets to strip it away. In this case, browsers will throw DOMException (Chromium) or SyntaxError (Firefox), so the token doesn't leak.

Thoughts @dbrgn?

Edit: Added port.

[dbrgn]

We're not following that for Threema, we use a custom binary protocol to reduce the amount of data that needs to be encoded in the QR code. (The format will be documented on release, but may change in the future. There's a version field in the data for that.)

I don't think we should standardize the format itself, just list the data that should be exchanged:

• Initiator permanent public key
• Auth token
• SaltyRTC server host
• SaltyRTC server port
• SaltyRTC server permanent public key

[dbrgn]

Ah, I didn't really read the suggestion properly the first time. You're proposing to change the websocket server path. That would be fine with me generally, although we won't use the full format (with hash) to transfer data through the QR code.

Regarding group conversations, I'll continue the discussion in #83.

[lgrahl]

Only listing the data that needs to be exchanged would be fine by me. However, I'd want to add the scheme above as an example.

[dbrgn]

Feel free to create a proposal. As this is documentation only, it should not break compatibility.