we know that if a subscriber wants to subscribe to a MAM channel, he must have the channel ID or root, and the sideKey if the channel mode is restricted. How the publisher can send these access information securely to authorized parties or subscribers? are these access information sent over the tangle or using another way?
there is no safe way to send the credentials inside of MAM.
MAM is going to be deprecated soon, please have a look at it new concept called IOTA Streams.
In IOTA Streams it is different now, you need to have the "state" of the channel to read, which means, all messages absorbed in a chronological way, which is then used to read the next message. The first time, all you need to do is send a subscribe message to the author, after reading the announce message of said author.
That announce message is public, and anyone with the link can generate a subscribe message. It depends on the author to accept the subscription or not.
Concise steps are:
- Author announces the channel
- Subscriber sends the subscriber ID to the author
- The author adds the subscriber ID to the channel
- The subscriber can now read the information in the streams channel
This is also a good video by AleB about IOTA Streams: https://www.youtube.com/watch?v=EycFnTG748c