ChromeOS cryptohome should be able to use gaia id as user identifier.

chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.h

Index: chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.h
diff --git a/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.h b/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.h
index 49f334f69f8300e2c114aab2e21c526754ae4037..e99e70afff3b4699f92cf681f93c3462bb7ec4c7 100644
--- a/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.h
+++ b/chrome/browser/extensions/api/enterprise_platform_keys_private/enterprise_platform_keys_private_api.h
@@ -16,6 +16,7 @@
 #include "chromeos/attestation/attestation_flow.h"
 #include "chromeos/dbus/cryptohome_client.h"
 #include "chromeos/dbus/dbus_method_call_status.h"
+#include "components/signin/core/account_id/account_id.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
 class PrefService;
@@ -84,6 +85,9 @@ class EPKPChallengeKeyBase : public ChromeAsyncExtensionFunction {
   // Returns the user email.
   std::string GetUserEmail() const;
 
+  // Returns account id.
+  AccountId GetAccountId() const;
+
   // Returns the enterprise virtual device ID.
   std::string GetDeviceId() const;
 
@@ -93,7 +97,7 @@ class EPKPChallengeKeyBase : public ChromeAsyncExtensionFunction {
   // user consent before calling GetCertificate().
   void PrepareKey(
       chromeos::attestation::AttestationKeyType key_type,
-      const std::string& user_id,
+      const AccountId& account_id,
       const std::string& key_name,
       chromeos::attestation::AttestationCertificateProfile certificate_profile,
       bool require_user_consent,
@@ -107,18 +111,17 @@ class EPKPChallengeKeyBase : public ChromeAsyncExtensionFunction {
  private:
   // Holds the context of a PrepareKey() operation.
   struct PrepareKeyContext {
-    PrepareKeyContext(
-        chromeos::attestation::AttestationKeyType key_type,
-        const std::string& user_id,
-        const std::string& key_name,
-        chromeos::attestation::AttestationCertificateProfile
-            certificate_profile,
-        bool require_user_consent,
-        const base::Callback<void(PrepareKeyResult)>& callback);
+    PrepareKeyContext(chromeos::attestation::AttestationKeyType key_type,
+                      const AccountId& account_id,
+                      const std::string& key_name,
+                      chromeos::attestation::AttestationCertificateProfile
+                          certificate_profile,
+                      bool require_user_consent,
+                      const base::Callback<void(PrepareKeyResult)>& callback);

[Darren Krahn, 2016/02/17 20:48:05]

Just a heads up -- this will likely conflict with
https://chromiumcodereview.appspot.com/1685103003/.

[Alexander Alekseev, 2016/02/18 13:45:14]

Thank you for pointing out. I'll look at it.

     ~PrepareKeyContext();
 
     chromeos::attestation::AttestationKeyType key_type;
-    const std::string user_id;
+    const AccountId account_id;
     const std::string key_name;
     chromeos::attestation::AttestationCertificateProfile certificate_profile;
     bool require_user_consent;