0x01 S01PacketEncryptionRequest
Requests the client to enable encryption by sending the server's RSA public key, a verify token (random challenge), and server ID for Mojang session auth.
Fields
| Field | Type | Description |
|---|---|---|
| serverId | String | Server ID for Mojang session auth (empty string in 1.8.9) |
| publicKey | byte[] (DER-encoded) | Server's RSA public key for encrypting the shared secret |
| verifyToken | byte[] (4 random bytes) | Random challenge bytes the client must encrypt and return |
Wire Encoding
| Field | Type | Notes |
|---|---|---|
| Server ID | String | Usually empty for auth |
| Public Key Length | VarInt | Length of DER-encoded RSA public key |
| Public Key | byte[] | Server's RSA public key in DER format |
| Verify Token Length | VarInt | Length of verify token |
| Verify Token | byte[] | 4 random bytes for challenge-response |
MCP References
MCP
NetHandlerLoginClient.handleEncryptionRequest()Handler Interface
HND
INetHandlerLoginClientNotes
After receiving this, the client generates a random AES shared secret, encrypts it + the verify token with the server's public key, and sends them back in C01PacketEncryptionResponse. Also authenticates with Mojang's session server using the serverId hash.
implementation Implementation Cases
CrackedBypass
Intercept encryption request, respond with fake authentication.
AuthSpoof
Intercept encryption request, respond with fake authentication.