Overview

Explore using J-PAKE to securely pass credentials to another device.

Tracking bug is bug 601644.

Engineers Involved

Setting up a new mobile device should only involve entering a short code on the desktop device
Secondary request, not a hard requirement, is that if the user has a mobile device, and is setting up a desktop device, that the flow is similar and still involves entering the key on the desktop

User chooses "quick setup" on new device
Device displays a setup key that contains both the initial secret and a channel ID
On a device that is authenticated, user chooses "add another device" and is prompted for that key
The two devices exchange messages to build the secure tunnel
The already-authenticated device passes all credentials (username/password/passphrase) to the new device
New device completes setup and starts syncing

Desktop: Client that has Fx Sync already set up
Mobile: Client that needs to be set up (of course this could be another desktop computer, too)
PIN: code that is displayed on Mobile and entered on Desktop
Secret: weak secret that is used to start the J-PAKE algorithm
Key: strong secret that both clients derive through J-PAKE

Mobile asks server for new channel ID (3 characters a-z0-9)
```
GET /new_channel  -->  "a7i"
```
Mobile generates PIN from channel ID + random weak secret (3 characters a-z0-9), computes and uploads J-PAKE msg 1
```
PUT /channel_id
```
Desktop asks user for the PIN, extracts channel ID and weak secret, fetches Mobile's msg 1
```
GET /channel_id
```
Desktop computes and uploads msg 1
```
PUT /channel_id
```
Mobile retrieves Desktop's msg 1
```
GET /channel_id
```
computes and uploads msg 2
```
PUT /channel_id
```
Desktop retrieves Mobile's msg 2
```
GET /channel_id
```
computes msg 2 and key, encrypts Sync credentials and uploads msg 2 and encrypted credentials
```
PUT /channel_id
```
Mobile retrieve's Desktop's msg 2 and encrypted credentials
```
GET /channel_id
```
computes key and decrypts Sync credentials.