servers.md: update authentication schemes

Author: mweinelt

servers.md

@@ -7,26 +7,62 @@
 | - Germany     | <ircs://irc.de.hackint.org:6697> |
 | - Netherlands | <ircs://irc.nl.hackint.org:6697> |
 
-We would like to encourage you to authenticate via one of the following schemes:
+## Authentication
+
+We would like to encourage you to authenticate via [SASL], so you will
+already be authenticated before your client tries to join channels,
+which results in a smoother connection setup.
 
 - password based (*easy*)
-  - SASL PLAIN
-- certificate based  (*moderately difficult*)
-  - SASL ECDSA-NIST256P
-  - SASL EXTERNAL
+  - [SASL PLAIN]
+- certificate based (*moderately difficult*)
+  - SASL ECDSA-NIST256P-CHALLENGE (atheme-specific)
+  - [SASL EXTERNAL]
   - CertFP
 
-We're currently using SHA256 fingerprints for SASL External and CertFP.
+### Certificate Fingerprint (SASL External, CertFP)
 
-Enrolling your fingerprint is just a matter of calling:
+To enroll the fingerprint of the certificate you are currently connected
+with call:
 
 ```
 /msg NickServ cert add
 ```
 
-This will automatically configure the fingerprint of the client 
-certificate you are currently connected with. You will now 
-automatically be identified by NickServ on every connect, when
-you present your client certificate.
+Presenting the client certificate on connect will subsequently
+authenticate you against services.
+
+We're currently using SHA256 fingerprints for SASL External and CertFP.
+
+### Public Key (ECDSA-NIST256P-CHALLENGE)
+
+If you are planning to use ECDSA-NIST256P, generate `prime256v1` ecparams
+and store the public key within the services. During the connection phase
+a challenge-based authentication will happen.
+
+#### Generate the ecparams and retrieve the public key
+
+```
+$ openssl ecparam -genkey -name prime256v1 -out ecdsa.pem
+$ openssl ec -noout -text -conv_form compressed -in ~/.weechat/ecdsa.pem | grep '^pub:' -A 3 | tail -n 3 | tr -d ' \n:' | xxd -r -p | base64
+```
+
+#### Configure the public key in your account
+
+```
+/msg NickServ set property pubkey <pubkey>
+```
+
+#### Showing your configured public key
+
+```
+/msg NickServ taxonomy
+```
+
+## Transports
 
 Other ways to connect exist, they use transports, check the menu for that.
+
+[SASL]: https://ircv3.net/docs/sasl-mechs
+[SASL PLAIN]: https://tools.ietf.org/search/rfc4616
+[SASL EXTERNAL]: https://tools.ietf.org/html/rfc4422#appendix-A