What happens during an iPhone restore I'm looking at the apticket system and capturing TSS data. I want to know all the steps in restoring and verifying the IPSW, and exactly what data is sent to the signing server. From what I understand, the steps are as follows.

IPSW downloaded
Device ECID, iOS version and a 'nonce' sent to iTunes server
Above info signed, along with a hash of the IPSW (to create an apticket), and sent back to the client
Apticket verified by bootloader (hard wired into device)


Is this correct, what format does an apticket take, is any other information used, and how is the 'nonce' generated?
You are basically correct. Information about the APTicket can be found here, and SHSH information can be found here. And here is a slideshow from iH8sn0w from JailbreakCon in 2012 that describes everything else that you could ever want to know about the process. The JailbreakCon link has a list of all talks and links to their videos and/or slides (if publicly available) should you be hungry for even more information.

As far as actually how the nonce is generated, the bootloaders have been dumped, but they're proprietary and protected by copyright law, so publishing their contents is illegal. You can, however, dump them yourself, and investigate on your own.