Here is a brief summary for anyone else who has the same problem.
As Alice Yang wrote, the bootloader bitrate is changed automatically. This seems to work very well. I have tested this with 125kBit and 1MBit, both worked without problems.
The CAN IDs are the default IDs of blhost/buspal:
TX (Host to LPC): 0x321
RX (LPC to host): 0x123
All communication takes place via the CAN 2.0 protocol with a maximum of 8 bytes of DLC.
As an example, a ping of the bootloader looks like this:
(000.000000) can0 TX - - 321 [2] 5A A6
(000.001908) can0 RX - - 123 [8] 5A A7 00 03 01 50 00 00
(000.006069) can0 RX - - 123 [2] FB 40