[Sync] Implement keystore migration support.

sync/protocol/nigori_specifics.proto

Index: sync/protocol/nigori_specifics.proto
diff --git a/sync/protocol/nigori_specifics.proto b/sync/protocol/nigori_specifics.proto
index 4f63ff4b696cef820912a04a0c987a8155cf0a7a..c26f358d32e5d12ee4487f61db79c75a4c34f493 100644
--- a/sync/protocol/nigori_specifics.proto
+++ b/sync/protocol/nigori_specifics.proto
@@ -47,10 +47,10 @@ message DeviceInformation {
 
 // Properties of nigori sync object.
 message NigoriSpecifics {
-  optional EncryptedData encrypted = 1;
+  optional EncryptedData encryption_keybag = 1;
   // True if |encrypted| is encrypted using a passphrase
   // explicitly set by the user.
-  optional bool using_explicit_passphrase = 2;
+  optional bool frozen_keybag = 2;
 
   // Obsolete encryption fields. These were deprecated due to legacy versions
   // that understand their usage but did not perform encryption properly.
@@ -91,8 +91,32 @@ message NigoriSpecifics {
   // User device information. Contains information about each device that has a
   // sync-enabled Chrome browser connected to the user account.
   repeated DeviceInformation device_information = 28;
-  
+
   // Enable syncing favicons as part of tab sync.
   optional bool sync_tab_favicons = 29;
+
+  // The state of the passphrase required to decrypt |encryption_keybag|.
+  enum PassphraseState {

[tim (not reviewing), 2012/09/06 01:04:20]

We called this PassphraseState elsewhere but it's confusing, since 'State' can
mean some sort of payload / collection of data associated with a payload... I
think PassphraseType would be clearer.

[Nicolas Zea, 2012/09/06 21:45:27]

Done. And changed the chrome enum as well.

+    // Gaia-based encryption passphrase. Deprecated.
+    IMPLICIT_PASSPHRASE = 1;
+    // Keystore key encryption passphrase. Uses |keystore_bootstrap| to
+    // decrypt |encryption_keybag|.
+    KEYSTORE_PASSPHRASE = 2;
+    // Previous Gaia-based passphrase frozen and treated as a custom passphrase.
+    FROZEN_IMPLICIT_PASSPHRASE  = 3;
+    // User provided custom passphrase.
+    CUSTOM_PASSPHRASE = 4;
+  }
+  optional PassphraseState passphrase_state = 30
+      [default = IMPLICIT_PASSPHRASE];

[tim (not reviewing), 2012/09/06 01:04:20]

it... seems a bit weird to make the default the value with 'Deprecated' written
next to it.

[Nicolas Zea, 2012/09/06 21:45:27]

I think it's correct though. The "migrated" state has certain requirements,
which an empty/default nigori node does not meet. 

+
+  // The keystore bootstrap blob. Encrypted with the keystore key, and contains
+  // the encryption key used to decrypt |encryption_keybag|.
+  // Only set if passphrase_state == KEYSTORE_PASSPHRASE.
+  optional EncryptedData keystore_bootstrap = 31;
+
+  // The time (in epoch milliseconds) at which the keystore migration was
+  // performed.
+  optional int64 keystore_migration_time = 32;
 }