Handshake

Flow without encryption (enc.enabled=false):

Client                                   Server
  │                                         │
  │── C→S 4000  ClientHello ───────────────>│
  │── C→S 2419  Authenticate ──────────────>│
  │                                         │
  │<─ S→C 2491  Authenticated ──────────────│
  │<─ S→C 2875  UserHomeRoom ───────────────│
  │<─ S→C 340   UserEffects ────────────────│
  │<─ S→C 1450  UserClothes ────────────────│
  │<─ S→C 3738  UserTrustedLevel ───────────│
  │<─ S→C 411   UserPermissions ────────────│
  │<─ S→C 2033  AvailabilityStatus ─────────│
  │<─ S→C 3928  Ping ───────────────────────│
  │<─ S→C 3284  NotificationsStatus ────────│
  │<─ S→C 1968  UserAchievementScore ───────│
  │<─ S→C 793   FirstLoginOfDay ────────────│
  │<─ S→C 2833  MysteryBoxKeys ─────────────│
  │<─ S→C 1452  BuildersClubExpired ────────│
  │<─ S→C 325   SupportTicketCategories ────│
  │<─ S→C 151   UserFavoriteRooms ──────────│
  │<─ S→C 222   GameCenterGameList ─────────│
  │<─ S→C 2893  GameCenterAccountInfo ──────│  (gameId 3)
  │<─ S→C 2893  GameCenterAccountInfo ──────│  (gameId 0)
  │<─ S→C 954   UserSubscription ───────────│
  │<─ S→C 2696  ModToolLoad ────────────────│  *(staff only)
  │<─ S→C 2501  InventoryAchievements ──────│
  │<─ S→C 2221  ActiveRestrictions ─────────│  *(if user has active restrictions/sanctions)
  │<─ S→C 3984  NavigatorSavedSearches ─────│  *(if user has saved searches)
  │                                         │
  │── C→S 2596  Pong ──────────────────────>│  (reply to Ping)

Flow with encryption (enc.enabled=true):

Client                                   Server
  │                                         │
  │── C→S 4000  ClientHello ───────────────>│
  │── C→S 3110  InitDiffieHandshake ───────>│
  │                                         │
  │<─ S→C 1347  InitDiffieHandshake ────────│  (signedPrime, signedGenerator)
  │                                         │
  │── C→S 773   CompleteDiffieHandshake ───>│  (clientPublicKey)
  │                                         │
  │<─ S→C 3885  CompleteDiffieHandshake ────│  (serverPublicKey)
  │                                         │
  │   [RC4 encryption active on both sides] │
  │                                         │
  │── C→S 2419  Authenticate ──────────────>│
  │                                         │
  │   (same as unencrypted flow above)      │

C→S 4000 - ClientHello

Nitro: RELEASE_VERSION - Naming convention only. Source: ReleaseVersionEvent, ClientHelloMessageComposer

First message sent by the client after connecting; identifies the renderer version string (e.g. "NITRO-1-6-6").

Body:
  version:     string   Client version string e.g. "NITRO-1-6-6"
  clientType:  string   Always "HTML5"
  platform:    int      Always 5 (HTML5)
  category:    int      Always 2 (BROWSER)

C→S 3110 - InitDiffieHandshake

Nitro: HANDSHAKE_INIT_DIFFIE Source: InitDiffieHandshakeEvent, InitDiffieHandshakeMessageComposer

Requests Diffie-Hellman key exchange parameters from the server to begin encrypted session setup. Only sent when enc.enabled=true.

Body: (empty)

C→S 773 - CompleteDiffieHandshake

Nitro: HANDSHAKE_COMPLETE_DIFFIE Source: CompleteDiffieHandshakeEvent, CompleteDiffieHandshakeMessageComposer

Completes the Diffie-Hellman key exchange by sending the client's public key. Server uses it to derive the shared RC4 session key.

Body: (empty)

C→S 2419 - Authenticate

Nitro: SECURITY_TICKET Source: SecureLoginEvent, SSOTicketMessageComposer

Authenticates the user by sending the SSO ticket generated by the CMS. Arcturus looks up the token in the users.auth_ticket database column.

Body:
  ticket:  string   SSO token from CMS
  time:    int      Client timestamp (milliseconds)

S→C 1347 - InitDiffieHandshake

Source: InitDiffieHandshakeComposer, InitDiffieHandshakeEvent

Delivers the RSA-signed DH prime and generator required for the client to start the Diffie-Hellman key exchange.

Body:
  signedPrime:     string   RSA-signed DH prime

S→C 3885 - CompleteDiffieHandshake

Source: CompleteDiffieHandshakeComposer, CompleteDiffieHandshakeEvent

Delivers the server's DH public key; also signals whether the client should enable RC4 encryption for outgoing data.

Body:
  serverPublicKey:   string   Server DH public key
  client_encryption: boolean

S→C 2491 - Authenticated

Source: SecureLoginOKComposer, AuthenticatedEvent

Confirms that the authentication succeeded. Triggers the client to start the post-login data burst sequence.

Body: (empty)

S→C 1004 - ConnectionError

Nitro: CONNECTION_ERROR Source: ConnectionErrorComposer, ConnectionErrorEvent

Signals a connection-level error with an error code and timestamp; client displays an error and disconnects.

Body:
  messageId:  int     Internal message ID (0 if none)
  errorCode:  int     Error code

S→C 3523 - HandshakeIdentityAccount

Nitro: HANDSHAKE_IDENTITY_ACCOUNT Source: UnknownRoomViewerComposer, IdentityAccountsEvent

Delivers account identity data as part of an alternative handshake flow.

Field	Type	Notes
count	int	Number of identity account entries
[count × id]	int	Account ID
[count × name]	string	Username