Add a lock to the managed user settings page and require authentication for unlocking.

chrome/browser/managed_mode/managed_user_passphrase.cc

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/managed_mode/managed_user_passphrase.h"
+
+#include <stdlib.h>
+#include <time.h>
+
+#include "base/base64.h"
+#include "base/logging.h"
+#include "crypto/encryptor.h"
+#include "crypto/symmetric_key.h"
+
+namespace {
+
+int kNumberOfIterations = 1;
+int kDerivedKeySize = 128;
+
+}
+
+ManagedUserPassphrase::ManagedUserPassphrase(const std::string &salt) {
+  salt_ = salt;
+  if (salt_.size() == 0) {

[Bernhard Bauer, 2013/01/07 14:39:22]

You can use `salt_.empty()` here.

+    GenerateRandomSalt();
+  }
+}
+
+ManagedUserPassphrase::~ManagedUserPassphrase() {}
+
+std::string ManagedUserPassphrase::GetSalt() {
+  return salt_;
+}
+
+void ManagedUserPassphrase::GenerateRandomSalt() {
+  salt_ = "";

[Bernhard Bauer, 2013/01/07 14:39:22]

salt_.clear();

+  srand(time(0));

[Bernhard Bauer, 2013/01/07 14:39:22]

Please don't. I'm sure we have a cryptographic random number function somewhere.

+  for (int i = 0; i<32; ++i) {
+    salt_ += rand() % 128;
+  }
+  std::string temp = salt_;
+  if (!base::Base64Encode(temp, &salt_)) {
+    NOTREACHED();
+  }
+}
+
+void ManagedUserPassphrase::GenerateHashFromPassphrase(
+    const std::string& passphrase,
+    std::string* encoded_passphrase_hash) {
+  DCHECK(encoded_passphrase_hash);
+  std::string passphrase_hash;
+  GetPassphraseHash(passphrase, &passphrase_hash);
+  if (!base::Base64Encode(passphrase_hash, encoded_passphrase_hash)) {
+    NOTREACHED();
+  }
+}
+
+void ManagedUserPassphrase::GetPassphraseHash(const std::string& passphrase,
+    std::string* passphrase_hash) {
+  DCHECK(passphrase_hash);
+  // Create a hash from the user-provided passphrase and our hard-coded salt.
+  scoped_ptr<crypto::SymmetricKey> encryption_key(
+      crypto::SymmetricKey::DeriveKeyFromPassword(
+          crypto::SymmetricKey::AES,
+          passphrase,
+          salt_,
+          kNumberOfIterations,
+          kDerivedKeySize));
+  DCHECK(encryption_key.get());
+  if (!encryption_key->GetRawKey(passphrase_hash)) {
+    NOTREACHED();
+  }
+}