[Sync] Implement keystore migration support.

sync/protocol/nigori_specifics.proto

Index: sync/protocol/nigori_specifics.proto
diff --git a/sync/protocol/nigori_specifics.proto b/sync/protocol/nigori_specifics.proto
index 4f63ff4b696cef820912a04a0c987a8155cf0a7a..00685951c5e269b7731ed20b32acc228d160d380 100644
--- a/sync/protocol/nigori_specifics.proto
+++ b/sync/protocol/nigori_specifics.proto
@@ -47,10 +47,10 @@ message DeviceInformation {
 
 // Properties of nigori sync object.
 message NigoriSpecifics {
-  optional EncryptedData encrypted = 1;
+  optional EncryptedData encryption_keybag = 1;
   // True if |encrypted| is encrypted using a passphrase
   // explicitly set by the user.
-  optional bool using_explicit_passphrase = 2;
+  optional bool frozen_keybag = 2;

[tim (not reviewing), 2012/09/10 20:41:52]

Explain why this is called "frozen keybag" in a comment.

[Nicolas Zea, 2012/09/11 14:21:31]

Done.

 
   // Obsolete encryption fields. These were deprecated due to legacy versions
   // that understand their usage but did not perform encryption properly.
@@ -91,8 +91,32 @@ message NigoriSpecifics {
   // User device information. Contains information about each device that has a
   // sync-enabled Chrome browser connected to the user account.
   repeated DeviceInformation device_information = 28;
-  
+
   // Enable syncing favicons as part of tab sync.
   optional bool sync_tab_favicons = 29;
+
+  // The state of the passphrase required to decrypt |encryption_keybag|.
+  enum PassphraseType {
+    // Gaia-based encryption passphrase. Deprecated.
+    IMPLICIT_PASSPHRASE = 1;
+    // Keystore key encryption passphrase. Uses |keystore_bootstrap| to
+    // decrypt |encryption_keybag|.
+    KEYSTORE_PASSPHRASE = 2;
+    // Previous Gaia-based passphrase frozen and treated as a custom passphrase.
+    FROZEN_IMPLICIT_PASSPHRASE  = 3;
+    // User provided custom passphrase.
+    CUSTOM_PASSPHRASE = 4;
+  }
+  optional PassphraseType passphrase_type = 30
+      [default = IMPLICIT_PASSPHRASE];
+
+  // The keystore decryptor blob. Encrypted with the keystore key, and contains
+  // the encryption key used to decrypt |encryption_keybag|.
+  // Only set if passphrase_state == KEYSTORE_PASSPHRASE.
+  optional EncryptedData keystore_decryptor = 31;
+
+  // The time (in epoch milliseconds) at which the keystore migration was
+  // performed.
+  optional int64 keystore_migration_time = 32;
 }