Remove DirectoryCryptographer

This CL removes DirectoryCryptographer and its last usages.

Bug: 1083924
Change-Id: I800c9aee00c1f35e81fc177bf835ea76916bd760
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2228553
Commit-Queue: Maksim Moskvitin <mmoskvitin@google.com>
Reviewed-by: Mikel Astiz <mastiz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#779338}

components/sync/BUILD.gn

@@ -343,8 +343,6 @@ jumbo_static_library("rest_of_sync") {
     "syncable/directory_backing_store.cc",
     "syncable/directory_backing_store.h",
     "syncable/directory_change_delegate.h",
-    "syncable/directory_cryptographer.cc",
-    "syncable/directory_cryptographer.h",
     "syncable/entry.cc",
     "syncable/entry.h",
     "syncable/entry_kernel.cc",
@@ -653,7 +651,6 @@ source_set("unit_tests") {
     "protocol/proto_value_conversions_unittest.cc",
     "syncable/change_record_unittest.cc",
     "syncable/directory_backing_store_unittest.cc",
-    "syncable/directory_cryptographer_unittest.cc",
     "syncable/directory_unittest.cc",
     "syncable/directory_unittest.h",
     "syncable/entry_kernel_unittest.cc",

components/sync/engine_impl/directory_update_handler.cc

@@ -15,8 +15,8 @@
 #include "components/sync/engine_impl/cycle/data_type_debug_info_emitter.h"
 #include "components/sync/engine_impl/cycle/status_controller.h"
 #include "components/sync/engine_impl/update_applicator.h"
+#include "components/sync/nigori/cryptographer.h"
 #include "components/sync/syncable/directory.h"
-#include "components/sync/syncable/directory_cryptographer.h"
 #include "components/sync/syncable/model_neutral_mutable_entry.h"
 #include "components/sync/syncable/syncable_changes_version.h"
 #include "components/sync/syncable/syncable_model_neutral_write_transaction.h"

components/sync/engine_impl/get_commit_ids.cc

@@ -9,7 +9,7 @@
 #include "base/macros.h"
 #include "base/stl_util.h"
 #include "components/sync/engine_impl/syncer_util.h"
-#include "components/sync/syncable/directory_cryptographer.h"
+#include "components/sync/nigori/cryptographer.h"
 #include "components/sync/syncable/entry.h"
 #include "components/sync/syncable/nigori_handler.h"
 #include "components/sync/syncable/nigori_util.h"
@@ -519,11 +519,11 @@ void GetCommitIdsForType(syncable::BaseTransaction* trans,
 
   ModelTypeSet encrypted_types;
   bool passphrase_missing = false;
-  const DirectoryCryptographer* cryptographer =
-      dir->GetNigoriHandler()->GetDirectoryCryptographer(trans);
+  const Cryptographer* cryptographer =
+      dir->GetNigoriHandler()->GetCryptographer(trans);
   if (cryptographer) {
     encrypted_types = dir->GetNigoriHandler()->GetEncryptedTypes(trans);
-    passphrase_missing = cryptographer->has_pending_keys();
+    passphrase_missing = cryptographer->CanEncrypt();
   }
 
   // We filter out all unready entries from the set of unsynced handles. This

components/sync/syncable/directory_cryptographer.cc

-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/sync/syncable/directory_cryptographer.h"
-
-#include <stddef.h>
-
-#include <algorithm>
-#include <utility>
-
-#include "base/base64.h"
-#include "base/logging.h"
-#include "base/memory/ptr_util.h"
-#include "components/sync/base/encryptor.h"
-#include "components/sync/protocol/nigori_specifics.pb.h"
-
-namespace syncer {
-
-KeyParams::KeyParams(KeyDerivationParams derivation_params,
-                     const std::string& password)
-    : derivation_params(derivation_params), password(password) {}
-
-KeyParams::KeyParams(const KeyParams& other) = default;
-KeyParams::KeyParams(KeyParams&& other) = default;
-KeyParams::~KeyParams() = default;
-
-CryptographerDataWithPendingKeys::CryptographerDataWithPendingKeys() = default;
-CryptographerDataWithPendingKeys::CryptographerDataWithPendingKeys(
-    CryptographerDataWithPendingKeys&& other) = default;
-CryptographerDataWithPendingKeys::~CryptographerDataWithPendingKeys() = default;
-
-DirectoryCryptographer::DirectoryCryptographer()
-    : key_bag_(NigoriKeyBag::CreateEmpty()) {}
-
-DirectoryCryptographer::~DirectoryCryptographer() {}
-
-void DirectoryCryptographer::CopyFrom(const DirectoryCryptographer& other) {
-  key_bag_.CopyFrom(other.key_bag_);
-  default_nigori_name_ = other.default_nigori_name_;
-  if (other.pending_keys_) {
-    pending_keys_ =
-        std::make_unique<sync_pb::EncryptedData>(*other.pending_keys_);
-  }
-}
-
-void DirectoryCryptographer::InitFromCryptographerDataWithPendingKeys(
-    const CryptographerDataWithPendingKeys& serialized_state) {
-  std::unique_ptr<sync_pb::EncryptedData> pending_keys;
-  if (serialized_state.pending_keys.has_value()) {
-    pending_keys = std::make_unique<sync_pb::EncryptedData>(
-        *serialized_state.pending_keys);
-  }
-  CopyFrom(DirectoryCryptographer(
-      NigoriKeyBag::CreateFromProto(
-          serialized_state.cryptographer_data.key_bag()),
-      serialized_state.cryptographer_data.default_key_name(),
-      std::move(pending_keys)));
-}
-
-CryptographerDataWithPendingKeys
-DirectoryCryptographer::ToCryptographerDataWithPendingKeys() const {
-  CryptographerDataWithPendingKeys output;
-  *output.cryptographer_data.mutable_key_bag() = key_bag_.ToProto();
-  output.cryptographer_data.set_default_key_name(default_nigori_name_);
-  if (pending_keys_) {
-    output.pending_keys = *pending_keys_;
-  }
-  return output;
-}
-
-void DirectoryCryptographer::Bootstrap(
-    const Encryptor& encryptor,
-    const std::string& restored_bootstrap_token) {
-  if (is_initialized()) {
-    NOTREACHED();
-    return;
-  }
-
-  std::string serialized_nigori_key =
-      UnpackBootstrapToken(encryptor, restored_bootstrap_token);
-  if (serialized_nigori_key.empty())
-    return;
-  ImportNigoriKey(serialized_nigori_key);
-}
-
-std::unique_ptr<Cryptographer> DirectoryCryptographer::Clone() const {
-  auto cryptographer = base::WrapUnique(new DirectoryCryptographer());
-  cryptographer->CopyFrom(*this);
-  return cryptographer;
-}
-
-bool DirectoryCryptographer::CanEncrypt() const {
-  return is_initialized() && !has_pending_keys();
-}
-
-bool DirectoryCryptographer::CanDecrypt(
-    const sync_pb::EncryptedData& data) const {
-  return key_bag_.HasKey(data.key_name());
-}
-
-bool DirectoryCryptographer::CanDecryptUsingDefaultKey(
-    const sync_pb::EncryptedData& data) const {
-  return !default_nigori_name_.empty() &&
-         data.key_name() == default_nigori_name_;
-}
-
-bool DirectoryCryptographer::EncryptString(
-    const std::string& serialized,
-    sync_pb::EncryptedData* encrypted) const {
-  if (default_nigori_name_.empty()) {
-    LOG(ERROR) << "Cryptographer not ready, failed to encrypt.";
-    return false;
-  }
-
-  if (CanDecryptUsingDefaultKey(*encrypted)) {
-    std::string original_serialized;
-    if (DecryptToString(*encrypted, &original_serialized) &&
-        original_serialized == serialized) {
-      DVLOG(2) << "Re-encryption unnecessary, encrypted data already matches.";
-      return true;
-    }
-  }
-
-  if (!key_bag_.HasKey(default_nigori_name_)) {
-    LOG(ERROR) << "Corrupt default key.";
-    return false;
-  }
-
-  return key_bag_.EncryptWithKey(default_nigori_name_, serialized, encrypted);
-}
-
-bool DirectoryCryptographer::DecryptToString(
-    const sync_pb::EncryptedData& encrypted,
-    std::string* decrypted) const {
-  return key_bag_.Decrypt(encrypted, decrypted);
-}
-
-bool DirectoryCryptographer::has_pending_keys() const {
-  return nullptr != pending_keys_.get();
-}
-
-bool DirectoryCryptographer::GetKeys(sync_pb::EncryptedData* encrypted) const {
-  DCHECK(encrypted);
-  DCHECK_NE(size_t(0), key_bag_.size());
-
-  // Create a bag of all the Nigori parameters we know about.
-  sync_pb::NigoriKeyBag bag = key_bag_.ToProto();
-
-  // Encrypt the bag with the default Nigori.
-  return Encrypt(bag, encrypted);
-}
-
-bool DirectoryCryptographer::AddKey(const KeyParams& params) {
-  return AddKeyImpl(
-      Nigori::CreateByDerivation(params.derivation_params, params.password),
-      /*set_as_default=*/true);
-}
-
-bool DirectoryCryptographer::AddNonDefaultKey(const KeyParams& params) {
-  DCHECK(is_initialized());
-  return AddKeyImpl(
-      Nigori::CreateByDerivation(params.derivation_params, params.password),
-      /*set_as_default=*/false);
-}
-
-bool DirectoryCryptographer::AddKeyFromBootstrapToken(
-    const Encryptor& encryptor,
-    const std::string& restored_bootstrap_token) {
-  // Create the new Nigori and make it the default encryptor.
-  std::string serialized_nigori_key =
-      UnpackBootstrapToken(encryptor, restored_bootstrap_token);
-  return ImportNigoriKey(serialized_nigori_key);
-}
-
-bool DirectoryCryptographer::AddKeyImpl(std::unique_ptr<Nigori> nigori,
-                                        bool set_as_default) {
-  DCHECK(nigori);
-  std::string key_name = key_bag_.AddKey(std::move(nigori));
-  if (key_name.empty()) {
-    NOTREACHED();
-    return false;
-  }
-
-  // Check if the key we just added can decrypt the pending keys and add them
-  // too if so.
-  if (pending_keys_.get() && CanDecrypt(*pending_keys_)) {
-    sync_pb::NigoriKeyBag pending_bag;
-    Decrypt(*pending_keys_, &pending_bag);
-    InstallKeyBag(pending_bag);
-    SetDefaultKey(pending_keys_->key_name());
-    pending_keys_.reset();
-  }
-
-  // The just-added key takes priority over the pending keys as default.
-  if (set_as_default)
-    SetDefaultKey(key_name);
-  return true;
-}
-
-void DirectoryCryptographer::InstallKeys(
-    const sync_pb::EncryptedData& encrypted) {
-  DCHECK(CanDecrypt(encrypted));
-
-  sync_pb::NigoriKeyBag bag;
-  if (!Decrypt(encrypted, &bag))
-    return;
-  InstallKeyBag(bag);
-}
-
-void DirectoryCryptographer::SetDefaultKey(const std::string& key_name) {
-  DCHECK(key_bag_.HasKey(key_name));
-  default_nigori_name_ = key_name;
-}
-
-bool DirectoryCryptographer::is_initialized() const {
-  return !default_nigori_name_.empty();
-}
-
-void DirectoryCryptographer::SetPendingKeys(
-    const sync_pb::EncryptedData& encrypted) {
-  DCHECK(!CanDecrypt(encrypted));
-  DCHECK(!encrypted.blob().empty());
-  pending_keys_ = std::make_unique<sync_pb::EncryptedData>(encrypted);
-}
-
-const sync_pb::EncryptedData& DirectoryCryptographer::GetPendingKeys() const {
-  DCHECK(has_pending_keys());
-  return *(pending_keys_.get());
-}
-
-bool DirectoryCryptographer::DecryptPendingKeys(const KeyParams& params) {
-  DCHECK_NE(KeyDerivationMethod::UNSUPPORTED,
-            params.derivation_params.method());
-
-  std::unique_ptr<Nigori> nigori =
-      Nigori::CreateByDerivation(params.derivation_params, params.password);
-
-  std::string plaintext;
-  if (!nigori->Decrypt(pending_keys_->blob(), &plaintext))
-    return false;
-
-  sync_pb::NigoriKeyBag bag;
-  if (!bag.ParseFromString(plaintext)) {
-    NOTREACHED();
-    return false;
-  }
-  InstallKeyBag(bag);
-  const std::string& new_default_key_name = pending_keys_->key_name();
-  SetDefaultKey(new_default_key_name);
-  pending_keys_.reset();
-  return true;
-}
-
-bool DirectoryCryptographer::GetBootstrapToken(const Encryptor& encryptor,
-                                               std::string* token) const {
-  DCHECK(token);
-  std::string unencrypted_token = GetDefaultNigoriKeyData();
-  if (unencrypted_token.empty())
-    return false;
-
-  std::string encrypted_token;
-  if (!encryptor.EncryptString(unencrypted_token, &encrypted_token)) {
-    return false;
-  }
-
-  base::Base64Encode(encrypted_token, token);
-
-  return true;
-}
-
-std::string DirectoryCryptographer::UnpackBootstrapToken(
-    const Encryptor& encryptor,
-    const std::string& token) const {
-  if (token.empty())
-    return std::string();
-
-  std::string encrypted_data;
-  if (!base::Base64Decode(token, &encrypted_data)) {
-    DLOG(WARNING) << "Could not decode token.";
-    return std::string();
-  }
-
-  std::string unencrypted_token;
-  if (!encryptor.DecryptString(encrypted_data, &unencrypted_token)) {
-    DLOG(WARNING) << "Decryption of bootstrap token failed.";
-    return std::string();
-  }
-  return unencrypted_token;
-}
-
-void DirectoryCryptographer::InstallKeyBag(const sync_pb::NigoriKeyBag& bag) {
-  key_bag_.AddAllUnknownKeysFrom(NigoriKeyBag::CreateFromProto(bag));
-}
-
-bool DirectoryCryptographer::KeybagIsStale(
-    const sync_pb::EncryptedData& encrypted_bag) const {
-  if (!CanEncrypt())
-    return false;
-  if (encrypted_bag.blob().empty())
-    return true;
-  if (!CanDecrypt(encrypted_bag))
-    return false;
-  if (!CanDecryptUsingDefaultKey(encrypted_bag))
-    return true;
-  sync_pb::NigoriKeyBag bag;
-  if (!Decrypt(encrypted_bag, &bag)) {
-    LOG(ERROR) << "Failed to decrypt keybag for stale check. "
-               << "Assuming keybag is corrupted.";
-    return true;
-  }
-  if (static_cast<size_t>(bag.key_size()) < key_bag_.size())
-    return true;
-  return false;
-}
-
-std::string DirectoryCryptographer::GetDefaultEncryptionKeyName() const {
-  return default_nigori_name_;
-}
-
-std::string DirectoryCryptographer::GetDefaultNigoriKeyData() const {
-  if (!is_initialized())
-    return std::string();
-  return key_bag_.ExportKey(default_nigori_name_).SerializeAsString();
-}
-
-bool DirectoryCryptographer::ImportNigoriKey(
-    const std::string& serialized_nigori_key) {
-  if (serialized_nigori_key.empty())
-    return false;
-
-  sync_pb::NigoriKey key;
-  if (!key.ParseFromString(serialized_nigori_key))
-    return false;
-
-  std::unique_ptr<Nigori> nigori = Nigori::CreateByImport(
-      key.deprecated_user_key(), key.encryption_key(), key.mac_key());
-
-  if (!nigori) {
-    DLOG(ERROR) << "Ignoring invalid Nigori when importing";
-    return false;
-  }
-
-  if (!AddKeyImpl(std::move(nigori), true))
-    return false;
-  return true;
-}
-
-DirectoryCryptographer::DirectoryCryptographer(
-    NigoriKeyBag key_bag,
-    const std::string& default_nigori_name,
-    std::unique_ptr<sync_pb::EncryptedData> pending_keys)
-    : key_bag_(std::move(key_bag)),
-      default_nigori_name_(std::move(default_nigori_name)),
-      pending_keys_(std::move(pending_keys)) {}
-
-}  // namespace syncer

components/sync/syncable/directory_cryptographer.h

-// Copyright 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef COMPONENTS_SYNC_SYNCABLE_DIRECTORY_CRYPTOGRAPHER_H_
-#define COMPONENTS_SYNC_SYNCABLE_DIRECTORY_CRYPTOGRAPHER_H_
-
-#include <map>
-#include <memory>
-#include <string>
-
-#include "base/macros.h"
-#include "base/optional.h"
-#include "components/sync/base/passphrase_enums.h"
-#include "components/sync/nigori/cryptographer.h"
-#include "components/sync/nigori/nigori.h"
-#include "components/sync/nigori/nigori_key_bag.h"
-#include "components/sync/protocol/encryption.pb.h"
-#include "components/sync/protocol/nigori_local_data.pb.h"
-
-namespace sync_pb {
-class NigoriKeyBag;
-}  // namespace sync_pb
-
-namespace syncer {
-
-class Encryptor;
-
-// The parameters used to initialize a Nigori instance.
-// TODO(davidovic): Stop relying on KeyParams and inline it, because it's now
-// just a pair of KeyDerivationParams and passphrase.
-struct KeyParams {
-  KeyParams(KeyDerivationParams derivation_params, const std::string& password);
-  KeyParams(const KeyParams& other);
-  KeyParams(KeyParams&& other);
-  ~KeyParams();
-
-  KeyDerivationParams derivation_params;
-  std::string password;
-};
-
-struct CryptographerDataWithPendingKeys {
-  CryptographerDataWithPendingKeys();
-  CryptographerDataWithPendingKeys(CryptographerDataWithPendingKeys&& other);
-  ~CryptographerDataWithPendingKeys();
-
-  sync_pb::CryptographerData cryptographer_data;
-  base::Optional<sync_pb::EncryptedData> pending_keys;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(CryptographerDataWithPendingKeys);
-};
-
-// This class manages the Nigori objects used to encrypt and decrypt sensitive
-// sync data (eg. passwords). Each Nigori object knows how to handle data
-// protected with a particular passphrase.
-//
-// Whenever an update to the Nigori sync node is received from the server,
-// SetPendingKeys should be called with the encrypted contents of that node.
-// Most likely, an updated Nigori node means that a new passphrase has been set
-// and that future node updates won't be decryptable. To remedy this, the user
-// should be prompted for the new passphrase and DecryptPendingKeys be called.
-//
-// Whenever a update to an encrypted node is received from the server,
-// CanDecrypt should be used to verify whether the Cryptographer can decrypt
-// that node. If it cannot, then the application of that update should be
-// delayed until after it can be decrypted.
-class DirectoryCryptographer : public Cryptographer {
- public:
-  DirectoryCryptographer();
-  ~DirectoryCryptographer() override;
-
-  void CopyFrom(const DirectoryCryptographer& other);
-
-  // Deserialization.
-  void InitFromCryptographerDataWithPendingKeys(
-      const CryptographerDataWithPendingKeys& serialized_state);
-
-  // Serialization.
-  CryptographerDataWithPendingKeys ToCryptographerDataWithPendingKeys() const;
-
-  // |restored_bootstrap_token| can be provided via this method to bootstrap
-  // Cryptographer instance into the ready state (is_ready will be true).
-  // It must be a string that was previously built by the
-  // GetSerializedBootstrapToken function.  It is possible that the token is no
-  // longer valid (due to server key change), in which case the normal
-  // decryption code paths will fail and the user will need to provide a new
-  // passphrase.
-  // It is an error to call this if is_ready() == true, though it is fair to
-  // never call Bootstrap at all.
-  void Bootstrap(const Encryptor& encryptor,
-                 const std::string& restored_bootstrap_token);
-
-  // Returns whether |encrypted| can be decrypted using the default encryption
-  // key.
-  bool CanDecryptUsingDefaultKey(const sync_pb::EncryptedData& encrypted) const;
-
-  // Encrypts the set of currently known keys into |encrypted|. Returns true if
-  // successful.
-  bool GetKeys(sync_pb::EncryptedData* encrypted) const;
-
-  // Creates a new Nigori instance using |params|. If successful, |params| will
-  // become the default encryption key and be used for all future calls to
-  // Encrypt.
-  // Will decrypt the pending keys and install them if possible (pending key
-  // will not overwrite default).
-  bool AddKey(const KeyParams& params);
-
-  // Same as AddKey(..), but builds the new Nigori from a previously persisted
-  // bootstrap token. This can be useful when consuming a bootstrap token
-  // with a cryptographer that has already been initialized.
-  // Updates the default key.
-  // Will decrypt the pending keys and install them if possible (pending key
-  // will not overwrite default).
-  bool AddKeyFromBootstrapToken(const Encryptor& encryptor,
-                                const std::string& restored_bootstrap_token);
-
-  // Creates a new Nigori instance using |params|. If successful, |params|
-  // will be added to the nigori keybag, but will not be the default encryption
-  // key (default_nigori_ will remain the same).
-  // Prereq: is_initialized() must be true.
-  // Will decrypt the pending keys and install them if possible (pending key
-  // will become the new default).
-  bool AddNonDefaultKey(const KeyParams& params);
-
-  // Decrypts |encrypted| and uses its contents to initialize Nigori instances.
-  // Returns true unless decryption of |encrypted| fails. The caller is
-  // responsible for checking that CanDecrypt(encrypted) == true.
-  // Does not modify the default key.
-  void InstallKeys(const sync_pb::EncryptedData& encrypted);
-
-  // Makes a local copy of |encrypted| to later be decrypted by
-  // DecryptPendingKeys. This should only be used if CanDecrypt(encrypted) ==
-  // false.
-  void SetPendingKeys(const sync_pb::EncryptedData& encrypted);
-
-  // Makes |pending_keys_| available to callers that may want to cache its
-  // value for later use on the UI thread. It is illegal to call this if the
-  // cryptographer has no pending keys. Like other calls that access the
-  // cryptographer, this method must be called from within a transaction.
-  const sync_pb::EncryptedData& GetPendingKeys() const;
-
-  // Attempts to decrypt the set of keys that was copied in the previous call to
-  // SetPendingKeys using |params|. Returns true if the pending keys were
-  // successfully decrypted and installed. If successful, the default key
-  // is updated.
-  bool DecryptPendingKeys(const KeyParams& params);
-
-  // Sets the default key to the nigori with name |key_name|. |key_name| must
-  // correspond to a nigori that has already been installed into the keybag.
-  void SetDefaultKey(const std::string& key_name);
-
-  bool is_initialized() const;
-
-  // Obtain a token that can be provided on construction to a future
-  // Cryptographer instance to bootstrap itself.  Returns false if such a token
-  // can't be created (i.e. if this Cryptograhper doesn't have valid keys).
-  bool GetBootstrapToken(const Encryptor& encryptor, std::string* token) const;
-
-  // Returns true if |keybag| is decryptable and either is a subset of
-  // |key_bag_| and/or has a different default key.
-  bool KeybagIsStale(const sync_pb::EncryptedData& keybag) const;
-
-  // Returns the name of the Nigori key currently used for encryption.
-  std::string GetDefaultEncryptionKeyName() const override;
-
-  // Returns a serialized sync_pb::NigoriKey version of current default
-  // encryption key. Returns empty string if Cryptographer is not initialized
-  // or protobuf serialization error occurs.
-  std::string GetDefaultNigoriKeyData() const;
-
-  // Generates a new Nigori from |serialized_nigori_key|, and if successful
-  // installs the new nigori as the default key.
-  bool ImportNigoriKey(const std::string& serialized_nigori_key);
-
-  bool has_pending_keys() const;
-
-  // Cryptographer overrides.
-  std::unique_ptr<Cryptographer> Clone() const override;
-  bool CanEncrypt() const override;
-  bool CanDecrypt(const sync_pb::EncryptedData& encrypted) const override;
-  bool EncryptString(const std::string& serialized,
-                     sync_pb::EncryptedData* encrypted) const override;
-  bool DecryptToString(const sync_pb::EncryptedData& encrypted,
-                       std::string* decrypted) const override;
-
- private:
-  // Initializes cryptographer with completely provided state.
-  DirectoryCryptographer(NigoriKeyBag key_bag,
-                         const std::string& default_nigori_name,
-                         std::unique_ptr<sync_pb::EncryptedData> pending_keys);
-
-  // Helper method to instantiate Nigori instances for each set of key
-  // parameters in |bag|.
-  // Does not update the default nigori.
-  void InstallKeyBag(const sync_pb::NigoriKeyBag& bag);
-
-  // Helper method to add a nigori to the keybag, optionally making it the
-  // default as well.
-  bool AddKeyImpl(std::unique_ptr<Nigori> nigori, bool set_as_default);
-
-  // Helper to unencrypt a bootstrap token into a serialized sync_pb::NigoriKey.
-  std::string UnpackBootstrapToken(const Encryptor& encryptor,
-                                   const std::string& token) const;
-
-  // The actual keys we know about.
-  NigoriKeyBag key_bag_;
-
-  // The key name associated with the default nigori. If non-empty, must
-  // correspond to a nigori within |key_bag_|.
-  std::string default_nigori_name_;
-
-  std::unique_ptr<sync_pb::EncryptedData> pending_keys_;
-
-  DISALLOW_ASSIGN(DirectoryCryptographer);
-};
-
-}  // namespace syncer
-
-#endif  // COMPONENTS_SYNC_SYNCABLE_DIRECTORY_CRYPTOGRAPHER_H_

components/sync/syncable/directory_cryptographer_unittest.cc

-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "components/sync/syncable/directory_cryptographer.h"
-
-#include "base/strings/string_util.h"
-#include "components/sync/base/fake_encryptor.h"
-#include "components/sync/protocol/nigori_local_data.pb.h"
-#include "components/sync/protocol/password_specifics.pb.h"
-#include "testing/gmock/include/gmock/gmock.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace syncer {
-
-namespace {
-
-using testing::_;
-using testing::Eq;
-using testing::Ne;
-using testing::SizeIs;
-
-}  // namespace
-
-class DirectoryCryptographerTest : public ::testing::Test {
- protected:
-  DirectoryCryptographerTest() = default;
-
-  FakeEncryptor encryptor_;
-  DirectoryCryptographer cryptographer_;
-};
-
-TEST_F(DirectoryCryptographerTest, EmptyCantDecrypt) {
-  EXPECT_FALSE(cryptographer_.CanEncrypt());
-
-  sync_pb::EncryptedData encrypted;
-  encrypted.set_key_name("foo");
-  encrypted.set_blob("bar");
-
-  EXPECT_FALSE(cryptographer_.CanDecrypt(encrypted));
-}
-
-TEST_F(DirectoryCryptographerTest, EmptyCantEncrypt) {
-  EXPECT_FALSE(cryptographer_.CanEncrypt());
-
-  sync_pb::EncryptedData encrypted;
-  sync_pb::PasswordSpecificsData original;
-  EXPECT_FALSE(cryptographer_.Encrypt(original, &encrypted));
-}
-
-TEST_F(DirectoryCryptographerTest, MissingCantDecrypt) {
-  KeyParams params = {KeyDerivationParams::CreateForPbkdf2(), "dummy"};
-  cryptographer_.AddKey(params);
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::EncryptedData encrypted;
-  encrypted.set_key_name("foo");
-  encrypted.set_blob("bar");
-
-  EXPECT_FALSE(cryptographer_.CanDecrypt(encrypted));
-}
-
-TEST_F(DirectoryCryptographerTest, CanEncryptAndDecrypt) {
-  KeyParams params = {KeyDerivationParams::CreateForPbkdf2(), "dummy"};
-  EXPECT_TRUE(cryptographer_.AddKey(params));
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::PasswordSpecificsData original;
-  original.set_origin("http://example.com");
-  original.set_username_value("azure");
-  original.set_password_value("hunter2");
-
-  sync_pb::EncryptedData encrypted;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted));
-
-  sync_pb::PasswordSpecificsData decrypted;
-  EXPECT_TRUE(cryptographer_.Decrypt(encrypted, &decrypted));
-
-  EXPECT_EQ(original.SerializeAsString(), decrypted.SerializeAsString());
-}
-
-TEST_F(DirectoryCryptographerTest, EncryptOnlyIfDifferent) {
-  KeyParams params = {KeyDerivationParams::CreateForPbkdf2(), "dummy"};
-  EXPECT_TRUE(cryptographer_.AddKey(params));
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::PasswordSpecificsData original;
-  original.set_origin("http://example.com");
-  original.set_username_value("azure");
-  original.set_password_value("hunter2");
-
-  sync_pb::EncryptedData encrypted;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted));
-
-  sync_pb::EncryptedData encrypted2, encrypted3;
-  encrypted2.CopyFrom(encrypted);
-  encrypted3.CopyFrom(encrypted);
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted2));
-
-  // Now encrypt with a new default key. Should overwrite the old data.
-  KeyParams params_new = {KeyDerivationParams::CreateForPbkdf2(), "dummy2"};
-  cryptographer_.AddKey(params_new);
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted3));
-
-  sync_pb::PasswordSpecificsData decrypted;
-  EXPECT_TRUE(cryptographer_.Decrypt(encrypted2, &decrypted));
-  // encrypted2 should match encrypted, encrypted3 should not (due to salting).
-  EXPECT_EQ(encrypted.SerializeAsString(), encrypted2.SerializeAsString());
-  EXPECT_NE(encrypted.SerializeAsString(), encrypted3.SerializeAsString());
-  EXPECT_EQ(original.SerializeAsString(), decrypted.SerializeAsString());
-}
-
-TEST_F(DirectoryCryptographerTest, AddKeySetsDefault) {
-  KeyParams params1 = {KeyDerivationParams::CreateForPbkdf2(), "dummy1"};
-  EXPECT_TRUE(cryptographer_.AddKey(params1));
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::PasswordSpecificsData original;
-  original.set_origin("http://example.com");
-  original.set_username_value("azure");
-  original.set_password_value("hunter2");
-
-  sync_pb::EncryptedData encrypted1;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted1));
-  sync_pb::EncryptedData encrypted2;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted2));
-
-  KeyParams params2 = {KeyDerivationParams::CreateForPbkdf2(), "dummy2"};
-  EXPECT_TRUE(cryptographer_.AddKey(params2));
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::EncryptedData encrypted3;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted3));
-  sync_pb::EncryptedData encrypted4;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted4));
-
-  EXPECT_EQ(encrypted1.key_name(), encrypted2.key_name());
-  EXPECT_NE(encrypted1.key_name(), encrypted3.key_name());
-  EXPECT_EQ(encrypted3.key_name(), encrypted4.key_name());
-}
-
-TEST_F(DirectoryCryptographerTest, EncryptExportDecrypt) {
-  sync_pb::EncryptedData nigori;
-  sync_pb::EncryptedData encrypted;
-
-  sync_pb::PasswordSpecificsData original;
-  original.set_origin("http://example.com");
-  original.set_username_value("azure");
-  original.set_password_value("hunter2");
-
-  {
-    DirectoryCryptographer cryptographer;
-
-    KeyParams params = {KeyDerivationParams::CreateForPbkdf2(), "dummy"};
-    cryptographer.AddKey(params);
-    EXPECT_TRUE(cryptographer.CanEncrypt());
-
-    EXPECT_TRUE(cryptographer.Encrypt(original, &encrypted));
-    EXPECT_TRUE(cryptographer.GetKeys(&nigori));
-  }
-
-  {
-    DirectoryCryptographer cryptographer;
-    EXPECT_FALSE(cryptographer.CanDecrypt(nigori));
-
-    cryptographer.SetPendingKeys(nigori);
-    EXPECT_FALSE(cryptographer.CanEncrypt());
-    EXPECT_TRUE(cryptographer.has_pending_keys());
-
-    KeyParams params = {KeyDerivationParams::CreateForPbkdf2(), "dummy"};
-    EXPECT_TRUE(cryptographer.DecryptPendingKeys(params));
-    EXPECT_TRUE(cryptographer.CanEncrypt());
-    EXPECT_FALSE(cryptographer.has_pending_keys());
-
-    sync_pb::PasswordSpecificsData decrypted;
-    EXPECT_TRUE(cryptographer.Decrypt(encrypted, &decrypted));
-    EXPECT_EQ(original.SerializeAsString(), decrypted.SerializeAsString());
-  }
-}
-
-TEST_F(DirectoryCryptographerTest, Bootstrap) {
-  KeyParams params = {KeyDerivationParams::CreateForPbkdf2(), "dummy"};
-  cryptographer_.AddKey(params);
-
-  std::string token;
-  EXPECT_TRUE(cryptographer_.GetBootstrapToken(encryptor_, &token));
-  EXPECT_TRUE(base::IsStringUTF8(token));
-
-  DirectoryCryptographer other_cryptographer;
-  other_cryptographer.Bootstrap(encryptor_, token);
-  EXPECT_TRUE(other_cryptographer.CanEncrypt());
-
-  const char secret[] = "secret";
-  sync_pb::EncryptedData encrypted;
-  EXPECT_TRUE(other_cryptographer.EncryptString(secret, &encrypted));
-  EXPECT_TRUE(cryptographer_.CanDecryptUsingDefaultKey(encrypted));
-}
-
-// Verifies that copied cryptographers are just as good as the original.
-//
-// Encrypt an item using the original cryptographer and two different sets of
-// keys.  Verify that it can decrypt them.
-//
-// Then copy the original cryptographer and ensure it can also decrypt these
-// items and encrypt them with the most recent key.
-TEST_F(DirectoryCryptographerTest, CopyConstructor) {
-  sync_pb::PasswordSpecificsData original;
-  original.set_origin("http://example.com");
-  original.set_username_value("luser");
-  original.set_password_value("p4ssw0rd");
-
-  // Start by testing the original cryptogprapher.
-  KeyParams params1 = {KeyDerivationParams::CreateForPbkdf2(), "dummy"};
-  EXPECT_TRUE(cryptographer_.AddKey(params1));
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::EncryptedData encrypted_k1;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted_k1));
-
-  KeyParams params2 = {KeyDerivationParams::CreateForPbkdf2(), "fatuous"};
-  EXPECT_TRUE(cryptographer_.AddKey(params2));
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::EncryptedData encrypted_k2;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted_k2));
-
-  sync_pb::PasswordSpecificsData decrypted_k1;
-  sync_pb::PasswordSpecificsData decrypted_k2;
-  EXPECT_TRUE(cryptographer_.Decrypt(encrypted_k1, &decrypted_k1));
-  EXPECT_TRUE(cryptographer_.Decrypt(encrypted_k2, &decrypted_k2));
-
-  EXPECT_EQ(original.SerializeAsString(), decrypted_k1.SerializeAsString());
-  EXPECT_EQ(original.SerializeAsString(), decrypted_k2.SerializeAsString());
-
-  // Clone the cryptographer and test that it behaves the same.
-  std::unique_ptr<Cryptographer> cryptographer_clone = cryptographer_.Clone();
-
-  // The clone should be able to decrypt with old and new keys.
-  sync_pb::PasswordSpecificsData decrypted_k1_clone;
-  sync_pb::PasswordSpecificsData decrypted_k2_clone;
-  EXPECT_TRUE(cryptographer_clone->Decrypt(encrypted_k1, &decrypted_k1_clone));
-  EXPECT_TRUE(cryptographer_clone->Decrypt(encrypted_k2, &decrypted_k2_clone));
-
-  EXPECT_EQ(original.SerializeAsString(),
-            decrypted_k1_clone.SerializeAsString());
-  EXPECT_EQ(original.SerializeAsString(),
-            decrypted_k2_clone.SerializeAsString());
-
-  // The old cryptographer should be able to decrypt things encrypted by the
-  // new.
-  sync_pb::EncryptedData encrypted_c;
-  EXPECT_TRUE(cryptographer_clone->Encrypt(original, &encrypted_c));
-
-  sync_pb::PasswordSpecificsData decrypted_c;
-  EXPECT_TRUE(cryptographer_.Decrypt(encrypted_c, &decrypted_c));
-  EXPECT_EQ(original.SerializeAsString(), decrypted_c.SerializeAsString());
-
-  // The cloned cryptographer should be using the latest key.
-  EXPECT_EQ(encrypted_c.key_name(), encrypted_k2.key_name());
-}
-
-// Test verifies that GetBootstrapToken/Bootstrap only transfers default
-// key. Additional call to GetKeys/InstallKeys is needed to transfer keybag
-// to decrypt messages encrypted with old keys.
-TEST_F(DirectoryCryptographerTest, GetKeysThenInstall) {
-  sync_pb::PasswordSpecificsData original;
-  original.set_origin("http://example.com");
-  original.set_username_value("luser");
-  original.set_password_value("p4ssw0rd");
-
-  // First, encrypt the same value using two different keys.
-  KeyParams params1 = {KeyDerivationParams::CreateForPbkdf2(), "dummy"};
-  EXPECT_TRUE(cryptographer_.AddKey(params1));
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::EncryptedData encrypted_k1;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted_k1));
-
-  KeyParams params2 = {KeyDerivationParams::CreateForPbkdf2(), "dummy2"};
-  EXPECT_TRUE(cryptographer_.AddKey(params2));
-  EXPECT_TRUE(cryptographer_.CanEncrypt());
-
-  sync_pb::EncryptedData encrypted_k2;
-  EXPECT_TRUE(cryptographer_.Encrypt(original, &encrypted_k2));
-
-  // Then construct second cryptographer and bootstrap it from the first one.
-  DirectoryCryptographer another_cryptographer;
-  std::string bootstrap_token;
-  EXPECT_TRUE(cryptographer_.GetBootstrapToken(encryptor_, &bootstrap_token));
-  another_cryptographer.Bootstrap(encryptor_, bootstrap_token);
-
-  // Before key installation, the second cryptographer should only be able
-  // to decrypt using the last key.
-  EXPECT_FALSE(another_cryptographer.CanDecrypt(encrypted_k1));
-  EXPECT_TRUE(another_cryptographer.CanDecrypt(encrypted_k2));
-
-  sync_pb::EncryptedData keys;
-  EXPECT_TRUE(cryptographer_.GetKeys(&keys));
-  ASSERT_TRUE(another_cryptographer.CanDecrypt(keys));
-  another_cryptographer.InstallKeys(keys);
-
-  // Verify that bootstrapped cryptographer decrypts succesfully using
-  // all the keys after key installation.
-  EXPECT_TRUE(another_cryptographer.CanDecrypt(encrypted_k1));
-  EXPECT_TRUE(another_cryptographer.CanDecrypt(encrypted_k2));
-}
-
-TEST_F(DirectoryCryptographerTest,
-       ShouldConvertToCryptographerDataWithPendingKeys) {
-  const KeyParams kKeyParams = {KeyDerivationParams::CreateForPbkdf2(),
-                                "password1"};
-  ASSERT_TRUE(cryptographer_.AddKey(kKeyParams));
-
-  CryptographerDataWithPendingKeys serialized =
-      cryptographer_.ToCryptographerDataWithPendingKeys();
-  EXPECT_THAT(serialized.cryptographer_data.key_bag().key(), SizeIs(1));
-
-  std::string expected_key_name;
-  Nigori::CreateByDerivation(kKeyParams.derivation_params, kKeyParams.password)
-      ->Permute(Nigori::Password, kNigoriKeyName, &expected_key_name);
-  EXPECT_THAT(serialized.cryptographer_data.default_key_name(),
-              Eq(expected_key_name));
-  EXPECT_THAT(serialized.cryptographer_data.key_bag().key(0).deprecated_name(),
-              Eq(expected_key_name));
-  EXPECT_THAT(
-      serialized.cryptographer_data.key_bag().key(0).deprecated_user_key(),
-      Ne(""));
-  EXPECT_THAT(serialized.cryptographer_data.key_bag().key(0).encryption_key(),
-              Ne(""));
-  EXPECT_THAT(serialized.cryptographer_data.key_bag().key(0).mac_key(), Ne(""));
-}
-
-}  // namespace syncer

components/sync/syncable/nigori_handler.h

@@ -16,7 +16,6 @@ class NigoriSpecifics;
 namespace syncer {
 
 class Cryptographer;
-class DirectoryCryptographer;
 enum class PassphraseType;
 
 namespace syncable {
@@ -46,11 +45,6 @@ class NigoriHandler {
   virtual const Cryptographer* GetCryptographer(
       const syncable::BaseTransaction* const trans) const = 0;
 
-  // Returns the full-blown DirectoryCryptographer API, available only if the
-  // legacy directory-based implementation of NIGORI is active.
-  virtual const DirectoryCryptographer* GetDirectoryCryptographer(
-      const syncable::BaseTransaction* const trans) const = 0;
-
   // Returns the set of currently encrypted types.
   virtual ModelTypeSet GetEncryptedTypes(
       const syncable::BaseTransaction* const trans) const = 0;

components/sync/syncable/nigori_handler_proxy.cc

@@ -97,11 +97,6 @@ const Cryptographer* NigoriHandlerProxy::GetCryptographer(
   return cryptographer_.get();
 }
 
-const DirectoryCryptographer* NigoriHandlerProxy::GetDirectoryCryptographer(
-    const syncable::BaseTransaction* const trans) const {
-  return nullptr;
-}
-
 ModelTypeSet NigoriHandlerProxy::GetEncryptedTypes(
     const syncable::BaseTransaction* const trans) const {
   DCHECK_EQ(user_share_->directory.get(), trans->directory());

components/sync/syncable/nigori_handler_proxy.h

@@ -63,8 +63,6 @@ class NigoriHandlerProxy : public SyncEncryptionHandler::Observer,
       const syncable::BaseTransaction* const trans) const override;
   const Cryptographer* GetCryptographer(
       const syncable::BaseTransaction* const trans) const override;
-  const DirectoryCryptographer* GetDirectoryCryptographer(
-      const syncable::BaseTransaction* const trans) const override;
   ModelTypeSet GetEncryptedTypes(
       const syncable::BaseTransaction* const trans) const override;
   PassphraseType GetPassphraseType(

components/sync/test/fake_sync_encryption_handler.cc

@@ -67,12 +67,6 @@ const Cryptographer* FakeSyncEncryptionHandler::GetCryptographer(
   return cryptographer_.get();
 }
 
-const DirectoryCryptographer*
-FakeSyncEncryptionHandler::GetDirectoryCryptographer(
-    const syncable::BaseTransaction* const trans) const {
-  return nullptr;
-}
-
 ModelTypeSet FakeSyncEncryptionHandler::GetEncryptedTypes(
     const syncable::BaseTransaction* const trans) const {
   return encrypted_types_;

components/sync/test/fake_sync_encryption_handler.h

@@ -53,8 +53,6 @@ class FakeSyncEncryptionHandler : public KeystoreKeysHandler,
       const syncable::BaseTransaction* const trans) const override;
   const Cryptographer* GetCryptographer(
       const syncable::BaseTransaction* const trans) const override;
-  const DirectoryCryptographer* GetDirectoryCryptographer(
-      const syncable::BaseTransaction* const trans) const override;
   ModelTypeSet GetEncryptedTypes(
       const syncable::BaseTransaction* const trans) const override;
   PassphraseType GetPassphraseType(