More protocol description, enough to implement sensor reports.

README.md

 a single byte with the sender ID and is recognized by the base station by its
 length.
 
+### Packet Format
+
 All encrypted packets follow the same scheme, with everything following after the
 salt being encrypted using a per-device XXTEA key hardcoded on the device and
 known to the base station. The packet fields are as follows, with multi-byte
 fields being encoded as little-endian:
 
 1. Device ID (1 byte)
-2. Salt (8 bytes)
+2. Remainder of salt (7 bytes)
 
    The most significant bit of the salt value is 0 for packets from the device
    to the base station and 1 for packets from the base station to the device.
 
-All fields from here on are encrypted with XXTEA, using the salt value contained
-in the packet.
-
-
+All fields from here on are encrypted with XXTEA, using the first 8 bytes of the
+packet as the salt.
 
 3. Packet type and element count (1 byte)
 
       count signals the number of different values requested.
    3. Values: Reply to a `GetValues` packet containing the requested information.
 
-4. Packet payload (variable)
+   The 3 most significant bits of the field encode the element count for packets
+   which can holt multiple elements (as described below).
+
+4. Packet payload (always 21 bytes, padded with zero bytes)
 
-   TODO
+   The payload field holds the packet content, with a variable format depending
+   on the packet type:
+
+   * Salt: The first 7 bytes of the payload hold the salt used by the sensor node
+     from this time on.
+   * Report: The payload consists of a number of (value type, value)-tuples. The
+     possible value types and the corresponding value suze are listed below.
 
 5. CRC-16-CCITT checksum
 
+### Value types:
+
+0. Time (4 bytes): The value is a unix time in seconds.
+1. Temperature (2 bytes): The value is a temperature value in tenths of degrees
+   celsius.
+2. Pressure (4 bytes): The value is a pressure in pascal.
+3. Humidity (2 bytes): The value is the relative humidity in tenths of a percent.
+
 # License
 
 The hardware contained in this repository is licensed under the [CERN Open Hardware Licence Version 2 - Weakly Reciprocal](cern_ohl_w_v2.txt), and the software is licensed under the [GNU General Public License v3](gpl-3.0.md).