The iPod app is contacting iTunes server to get some encrypted keys. Three of them actually, respectively called "signature", "certs" and "bag". All of them are part of an xml (plist) file located at
There's no POST data, just some cookies and HTTP headers giving information about the device and the context. These informations are part of many request made to Apple servers by iOS.
I have no idea what this "bag" can be nor what it's used for.
Here's the request headers :
User-Agent : iTunes-iPhone/4.3.4 (4; 32GB)
Accept-Language : fr;q=1.0,en;q=1.0[...]
X-Apple-Store-Front : [cut]
X-Apple-Connection-Type : WiFi
X-Apple-Cuid : [cut]
X-Apple-Software-Cuid : [cut]
X-Dsid : [cut]
X-Apple-Client-Application : MediaPlayer
X-Apple-Client-Versions : iBooks/1.3
The cookies names :
And the XML scheme :
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<data>[VERY long encrypted string]</data>
The "certs" part seems to be constant, even with a standard browser and none of the special HTTP headers or cookies.
(I don't want to publish too many details as I don't know what they contain about me or my Apple ID.)