[Sync] Add intelligent re-encryption support.

chrome/browser/sync/util/cryptographer.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_SYNC_UTIL_CRYPTOGRAPHER_H_
 #define CHROME_BROWSER_SYNC_UTIL_CRYPTOGRAPHER_H_
 #pragma once
 
 #include <map>
 #include <string>
@@ skipping 85 matching lines @@
   void Bootstrap(const std::string& restored_bootstrap_token);
 
   // Returns whether we can decrypt |encrypted| using the keys we currently know
   // about.
   bool CanDecrypt(const sync_pb::EncryptedData& encrypted) const;
 
   // Returns whether |encrypted| can be decrypted using the default encryption
   // key.
   bool CanDecryptUsingDefaultKey(const sync_pb::EncryptedData& encrypted) const;
 
+  // Same as Encrypt(..), except exits early and returns true if |message|
+  // matches the decrypted data within |encrypted| and |encrypted| was encrypted
+  // with the current default key. This avoids unnecessarily modifying
+  // |encrypted| if the change had no practical effect.
+  bool EncryptIfDifferent(const ::google::protobuf::MessageLite& message,
+                          sync_pb::EncryptedData* encrypted) const;
+
   // Encrypts |message| into |encrypted|. Returns true unless encryption fails.
   // Note that encryption will fail if |message| isn't valid (eg. a required
   // field isn't set).
   bool Encrypt(const ::google::protobuf::MessageLite& message,

[akalin, 2011/12/06 18:28:02]

Is there anything now besides tests that use Encrypt(), and can those tests use
EncryptIfDifferent?  It would be nice to have a single entry point for
encryption.

[Nicolas Zea, 2011/12/06 20:45:36]

There isn't, but I'm not sure that we want to remove the ability to force a
re-encryption with salting.

[akalin, 2011/12/09 23:52:42]

That's true.  But I'd like to remove it for now; we can always add it back in if
we need to.  If we do, we should probably rename it ForceEncryption or
something.

[Nicolas Zea, 2011/12/12 20:12:26]

Done.

                sync_pb::EncryptedData* encrypted) const;
 
   // Decrypts |encrypted| into |message|. Returns true unless decryption fails,
   // or |message| fails to parse the decrypted data.
   bool Decrypt(const sync_pb::EncryptedData& encrypted,
                ::google::protobuf::MessageLite* message) const;
 
   // Decrypts |encrypted| and returns plaintext decrypted data. If decryption
   // fails, returns empty string.
   std::string DecryptToString(const sync_pb::EncryptedData& encrypted) const;
 
   // Encrypts the set of currently known keys into |encrypted|. Returns true if
   // successful.

[akalin, 2011/12/06 18:28:02]

update comment to reflect change-only-if-different semantics

[Nicolas Zea, 2011/12/06 20:45:36]

Done.

   bool GetKeys(sync_pb::EncryptedData* encrypted) const;
 
   // Creates a new Nigori instance using |params|. If successful, |params| will
   // become the default encryption key and be used for all future calls to
   // Encrypt.
   bool AddKey(const KeyParams& params);
 
   // Decrypts |encrypted| and uses its contents to initialize Nigori instances.
   // Returns true unless decryption of |encrypted| fails. The caller is
   // responsible for checking that CanDecrypt(encrypted) == true.
@@ skipping 50 matching lines @@
   syncable::ModelTypeSet GetEncryptedTypes() const;
 
   // Forwards to MergeEncryptedTypes.
   void MergeEncryptedTypesForTest(
       const syncable::ModelTypeSet& encrypted_types);
 
  private:
   FRIEND_TEST_ALL_PREFIXES(CryptographerTest, PackUnpack);
   typedef std::map<std::string, linked_ptr<const Nigori> > NigoriMap;
 
+  bool EncryptImpl(const std::string& serialized,
+                   const NigoriMap::value_type* nigori,
+                   sync_pb::EncryptedData* encrypted) const;
+
   // Merges the given set of encrypted types with the existing set and emits a
   // notification if necessary.
   void MergeEncryptedTypes(const syncable::ModelTypeSet& encrypted_types);
 
   void EmitEncryptedTypesChangedNotification();
 
   // Helper method to instantiate Nigori instances for each set of key
   // parameters in |bag| and setting the default encryption key to
   // |default_key_name|.
   void InstallKeys(const std::string& default_key_name,
@@ skipping 15 matching lines @@
 
   syncable::ModelTypeSet encrypted_types_;
   bool encrypt_everything_;
 
   DISALLOW_COPY_AND_ASSIGN(Cryptographer);
 };
 
 }  // namespace browser_sync
 
 #endif  // CHROME_BROWSER_SYNC_UTIL_CRYPTOGRAPHER_H_