TBR: willchan

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@50541 0039d316-1c4b-4281-b951-d872f2087c98

28 files changed, 65 insertions, 509 deletions

diff --git a/chrome/browser/sync/engine/apply_updates_command.cc b/chrome/browser/sync/engine/apply_updates_command.cc
index 1853f2c..abce4db 100644
--- a/chrome/browser/sync/engine/apply_updates_command.cc
+++ b/chrome/browser/sync/engine/apply_updates_command.cc
@@ -28,10 +28,8 @@ void ApplyUpdatesCommand::ModelChangingExecuteImpl(SyncSession* session) {
   syncable::Directory::UnappliedUpdateMetaHandles handles;
   dir->GetUnappliedUpdateMetaHandles(&trans, &handles);
 
-  UpdateApplicator applicator(
-      session->context()->resolver(),
-      session->context()->directory_manager()->cryptographer(),
-      handles.begin(), handles.end(), session->routing_info(),
+  UpdateApplicator applicator(session->context()->resolver(), handles.begin(),
+      handles.end(), session->routing_info(),
       session->status_controller()->group_restriction());
   while (applicator.AttemptOneApplication(&trans)) {}
   applicator.SaveProgressIntoSessionState(
diff --git a/chrome/browser/sync/engine/apply_updates_command_unittest.cc b/chrome/browser/sync/engine/apply_updates_command_unittest.cc
index 4643239..4ec7ee3 100644
--- a/chrome/browser/sync/engine/apply_updates_command_unittest.cc
+++ b/chrome/browser/sync/engine/apply_updates_command_unittest.cc
@@ -35,8 +35,6 @@ class ApplyUpdatesCommandTest : public SyncerCommandTest {
     mutable_routing_info()->clear();
     workers()->push_back(new ModelSafeWorker());  // GROUP_PASSIVE worker.
     (*mutable_routing_info())[syncable::BOOKMARKS] = GROUP_PASSIVE;
-    (*mutable_routing_info())[syncable::PASSWORDS] = GROUP_PASSIVE;
-    (*mutable_routing_info())[syncable::NIGORI] = GROUP_PASSIVE;
     SyncerCommandTest::SetUp();
   }
 
@@ -60,23 +58,6 @@ class ApplyUpdatesCommandTest : public SyncerCommandTest {
     entry.Put(syncable::SERVER_SPECIFICS, default_bookmark_specifics);
   }
 
-  void CreateUnappliedNewItem(const string& item_id,
-                              const sync_pb::EntitySpecifics& specifics) {
-    ScopedDirLookup dir(syncdb().manager(), syncdb().name());
-    ASSERT_TRUE(dir.good());
-    WriteTransaction trans(dir, UNITTEST, __FILE__, __LINE__);
-    MutableEntry entry(&trans, syncable::CREATE_NEW_UPDATE_ITEM,
-        Id::CreateFromServerId(item_id));
-    ASSERT_TRUE(entry.good());
-    entry.Put(syncable::SERVER_VERSION, next_revision_++);
-    entry.Put(syncable::IS_UNAPPLIED_UPDATE, true);
-
-    entry.Put(syncable::SERVER_NON_UNIQUE_NAME, item_id);
-    entry.Put(syncable::SERVER_PARENT_ID, syncable::kNullId);
-    entry.Put(syncable::SERVER_IS_DIR, false);
-    entry.Put(syncable::SERVER_SPECIFICS, specifics);
-  }
-
   ApplyUpdatesCommand apply_updates_command_;
 
  private:
@@ -163,125 +144,4 @@ TEST_F(ApplyUpdatesCommandTest, ItemsBothKnownAndUnknown) {
       << "The updates with known ancestors should be successfully applied";
 }
 
-TEST_F(ApplyUpdatesCommandTest, DecryptablePassword) {
-  // Decryptable password updates should be applied.
-  Cryptographer* cryptographer =
-      session()->context()->directory_manager()->cryptographer();
-
-  browser_sync::KeyParams params = {"localhost", "dummy", "foobar"};
-  cryptographer->AddKey(params);
-
-  sync_pb::EntitySpecifics specifics;
-  sync_pb::PasswordSpecificsData data;
-  data.set_origin("http://example.com");
-
-  cryptographer->Encrypt(data,
-      specifics.MutableExtension(sync_pb::password)->mutable_encrypted());
-  CreateUnappliedNewItem("item", specifics);
-
-  apply_updates_command_.ExecuteImpl(session());
-
-  sessions::StatusController* status = session()->status_controller();
-  sessions::ScopedModelSafeGroupRestriction r(status, GROUP_PASSIVE);
-  EXPECT_EQ(1, status->update_progress().AppliedUpdatesSize())
-      << "All updates should have been attempted";
-  EXPECT_EQ(0, status->conflict_progress().ConflictingItemsSize())
-      << "No update should be in conflict because they're all decryptable";
-  EXPECT_EQ(1, status->update_progress().SuccessfullyAppliedUpdateCount())
-      << "The updates that can be decrypted should be applied";
-}
-
-TEST_F(ApplyUpdatesCommandTest, UndecryptablePassword) {
-  // Undecryptable password updates should not be applied.
-  sync_pb::EntitySpecifics specifics;
-  specifics.MutableExtension(sync_pb::password);
-  CreateUnappliedNewItem("item", specifics);
-
-  apply_updates_command_.ExecuteImpl(session());
-
-  sessions::StatusController* status = session()->status_controller();
-  sessions::ScopedModelSafeGroupRestriction r(status, GROUP_PASSIVE);
-  EXPECT_EQ(1, status->update_progress().AppliedUpdatesSize())
-      << "All updates should have been attempted";
-  EXPECT_EQ(1, status->conflict_progress().ConflictingItemsSize())
-      << "The updates that can't be decrypted should be in conflict";
-  EXPECT_EQ(0, status->update_progress().SuccessfullyAppliedUpdateCount())
-      << "No update that can't be decrypted should be applied";
-}
-
-TEST_F(ApplyUpdatesCommandTest, SomeUndecryptablePassword) {
-  // Only decryptable password updates should be applied.
-  {
-    Cryptographer* cryptographer =
-        session()->context()->directory_manager()->cryptographer();
-
-    KeyParams params = {"localhost", "dummy", "foobar"};
-    cryptographer->AddKey(params);
-
-    sync_pb::EntitySpecifics specifics;
-    sync_pb::PasswordSpecificsData data;
-    data.set_origin("http://example.com/1");
-
-    cryptographer->Encrypt(data,
-        specifics.MutableExtension(sync_pb::password)->mutable_encrypted());
-    CreateUnappliedNewItem("item1", specifics);
-  }
-  {
-    // Create a new cryptographer, independent of the one in the session.
-    Cryptographer cryptographer;
-    KeyParams params = {"localhost", "dummy", "bazqux"};
-    cryptographer.AddKey(params);
-
-    sync_pb::EntitySpecifics specifics;
-    sync_pb::PasswordSpecificsData data;
-    data.set_origin("http://example.com/2");
-
-    cryptographer.Encrypt(data,
-        specifics.MutableExtension(sync_pb::password)->mutable_encrypted());
-    CreateUnappliedNewItem("item2", specifics);
-  }
-
-  apply_updates_command_.ExecuteImpl(session());
-
-  sessions::StatusController* status = session()->status_controller();
-  sessions::ScopedModelSafeGroupRestriction r(status, GROUP_PASSIVE);
-  EXPECT_EQ(2, status->update_progress().AppliedUpdatesSize())
-      << "All updates should have been attempted";
-  EXPECT_EQ(1, status->conflict_progress().ConflictingItemsSize())
-      << "The decryptable password update should be applied";
-  EXPECT_EQ(1, status->update_progress().SuccessfullyAppliedUpdateCount())
-      << "The undecryptable password update shouldn't be applied";
-}
-
-TEST_F(ApplyUpdatesCommandTest, NigoriUpdate) {
-  // Nigori node updates should update the Cryptographer.
-  Cryptographer other_cryptographer;
-  KeyParams params = {"localhost", "dummy", "foobar"};
-  other_cryptographer.AddKey(params);
-
-  sync_pb::EntitySpecifics specifics;
-  other_cryptographer.GetKeys(
-      specifics.MutableExtension(sync_pb::nigori)->mutable_encrypted());
-
-  CreateUnappliedNewItem("item", specifics);
-
-  Cryptographer* cryptographer =
-      session()->context()->directory_manager()->cryptographer();
-  EXPECT_FALSE(cryptographer->has_pending_keys());
-
-  apply_updates_command_.ExecuteImpl(session());
-
-  sessions::StatusController* status = session()->status_controller();
-  sessions::ScopedModelSafeGroupRestriction r(status, GROUP_PASSIVE);
-  EXPECT_EQ(1, status->update_progress().AppliedUpdatesSize())
-      << "All updates should have been attempted";
-  EXPECT_EQ(0, status->conflict_progress().ConflictingItemsSize())
-      << "The nigori update shouldn't be in conflict";
-  EXPECT_EQ(1, status->update_progress().SuccessfullyAppliedUpdateCount())
-      << "The nigori update should be applied";
-
-  EXPECT_FALSE(cryptographer->is_ready());
-  EXPECT_TRUE(cryptographer->has_pending_keys());
-}
-
 }  // namespace browser_sync
diff --git a/chrome/browser/sync/engine/build_and_process_conflict_sets_command.cc b/chrome/browser/sync/engine/build_and_process_conflict_sets_command.cc
index ca27be0..be45cdd 100644
--- a/chrome/browser/sync/engine/build_and_process_conflict_sets_command.cc
+++ b/chrome/browser/sync/engine/build_and_process_conflict_sets_command.cc
@@ -47,9 +47,8 @@ bool BuildAndProcessConflictSetsCommand::BuildAndProcessConflictSets(
     BuildConflictSets(&trans,
         session->status_controller()->mutable_conflict_progress());
     had_single_direction_sets = ProcessSingleDirectionConflictSets(&trans,
-        session->context()->resolver(),
-        session->context()->directory_manager()->cryptographer(),
-        session->status_controller(), session->routing_info());
+        session->context()->resolver(), session->status_controller(),
+        session->routing_info());
     // We applied some updates transactionally, lets try syncing again.
     if (had_single_direction_sets)
       return true;
@@ -59,8 +58,7 @@ bool BuildAndProcessConflictSetsCommand::BuildAndProcessConflictSets(
 
 bool BuildAndProcessConflictSetsCommand::ProcessSingleDirectionConflictSets(
     syncable::WriteTransaction* trans, ConflictResolver* resolver,
-    Cryptographer* cryptographer, StatusController* status,
-    const ModelSafeRoutingInfo& routes) {
+    StatusController* status, const ModelSafeRoutingInfo& routes) {
   bool rv = false;
   set<ConflictSet*>::const_iterator all_sets_iterator;
   for (all_sets_iterator = status->conflict_progress().ConflictSetsBegin();
@@ -81,8 +79,8 @@ bool BuildAndProcessConflictSetsCommand::ProcessSingleDirectionConflictSets(
     if (conflict_set->size() == unsynced_count && 0 == unapplied_count) {
       LOG(INFO) << "Skipped transactional commit attempt.";
     } else if (conflict_set->size() == unapplied_count && 0 == unsynced_count &&
-          ApplyUpdatesTransactionally(trans, conflict_set, resolver,
-                                      cryptographer, routes, status)) {
+          ApplyUpdatesTransactionally(trans, conflict_set, resolver, routes,
+                                      status)) {
       rv = true;
     }
     ++all_sets_iterator;
@@ -148,7 +146,6 @@ bool BuildAndProcessConflictSetsCommand::ApplyUpdatesTransactionally(
     syncable::WriteTransaction* trans,
     const vector<syncable::Id>* const update_set,
     ConflictResolver* resolver,
-    Cryptographer* cryptographer,
     const ModelSafeRoutingInfo& routes,
     StatusController* status) {
   // The handles in the |update_set| order.
@@ -195,9 +192,8 @@ bool BuildAndProcessConflictSetsCommand::ApplyUpdatesTransactionally(
 
   // 5. Use the usual apply updates from the special start state we've just
   // prepared.
-  UpdateApplicator applicator(resolver, cryptographer,
-                              handles.begin(), handles.end(),
-                              routes, status->group_restriction());
+  UpdateApplicator applicator(resolver, handles.begin(), handles.end(),
+      routes, status->group_restriction());
   while (applicator.AttemptOneApplication(trans)) {
     // Keep going till all updates are applied.
   }
diff --git a/chrome/browser/sync/engine/build_and_process_conflict_sets_command.h b/chrome/browser/sync/engine/build_and_process_conflict_sets_command.h
index e2edb22..00cca6d 100644
--- a/chrome/browser/sync/engine/build_and_process_conflict_sets_command.h
+++ b/chrome/browser/sync/engine/build_and_process_conflict_sets_command.h
@@ -22,7 +22,6 @@ class WriteTransaction;
 namespace browser_sync {
 
 class ConflictResolver;
-class Cryptographer;
 
 namespace sessions {
 class ConflictProgress;
@@ -42,13 +41,11 @@ class BuildAndProcessConflictSetsCommand : public ModelChangingSyncerCommand {
 
   bool ProcessSingleDirectionConflictSets(
       syncable::WriteTransaction* trans, ConflictResolver* resolver,
-      Cryptographer* cryptographer, sessions::StatusController* status,
-      const ModelSafeRoutingInfo& routes);
+      sessions::StatusController* status, const ModelSafeRoutingInfo& routes);
   bool ApplyUpdatesTransactionally(
       syncable::WriteTransaction* trans,
       const std::vector<syncable::Id>* const update_set,
       ConflictResolver* resolver,
-      Cryptographer* cryptographer,
       const ModelSafeRoutingInfo& routes,
       sessions::StatusController* status);
   void BuildConflictSets(syncable::BaseTransaction* trans,
diff --git a/chrome/browser/sync/engine/model_safe_worker.cc b/chrome/browser/sync/engine/model_safe_worker.cc
index 3f3ddb4..7322073 100644
--- a/chrome/browser/sync/engine/model_safe_worker.cc
+++ b/chrome/browser/sync/engine/model_safe_worker.cc
@@ -30,8 +30,6 @@ std::string ModelSafeGroupToString(ModelSafeGroup group) {
       return "GROUP_HISTORY";
     case GROUP_PASSIVE:
       return "GROUP_PASSIVE";
-    case GROUP_PASSWORD:
-      return "GROUP_PASSWORD";
     default:
       NOTREACHED();
       return "INVALID";
diff --git a/chrome/browser/sync/engine/syncapi.cc b/chrome/browser/sync/engine/syncapi.cc
index 3b3423e..20d6a2c 100644
--- a/chrome/browser/sync/engine/syncapi.cc
+++ b/chrome/browser/sync/engine/syncapi.cc
@@ -39,7 +39,6 @@
 #include "chrome/browser/sync/protocol/password_specifics.pb.h"
 #include "chrome/browser/sync/protocol/preference_specifics.pb.h"
 #include "chrome/browser/sync/protocol/service_constants.h"
-#include "chrome/browser/sync/protocol/sync.pb.h"
 #include "chrome/browser/sync/protocol/theme_specifics.pb.h"
 #include "chrome/browser/sync/protocol/typed_url_specifics.pb.h"
 #include "chrome/browser/sync/sessions/sync_session_context.h"
@@ -64,8 +63,6 @@ using browser_sync::AllStatus;
 using browser_sync::AllStatusEvent;
 using browser_sync::AuthWatcher;
 using browser_sync::AuthWatcherEvent;
-using browser_sync::Cryptographer;
-using browser_sync::KeyParams;
 using browser_sync::ModelSafeRoutingInfo;
 using browser_sync::ModelSafeWorker;
 using browser_sync::ModelSafeWorkerRegistrar;
@@ -73,7 +70,6 @@ using browser_sync::Syncer;
 using browser_sync::SyncerEvent;
 using browser_sync::SyncerThread;
 using browser_sync::UserSettings;
-using browser_sync::kNigoriTag;
 using browser_sync::sessions::SyncSessionContext;
 using notifier::TalkMediator;
 using notifier::TalkMediatorImpl;
@@ -83,7 +79,6 @@ using std::string;
 using std::vector;
 using syncable::Directory;
 using syncable::DirectoryManager;
-using syncable::Entry;
 using syncable::SPECIFICS;
 
 typedef GoogleServiceAuthError AuthError;
@@ -178,23 +173,6 @@ std::string BaseNode::GenerateSyncableHash(
   return encode_output;
 }
 
-bool BaseNode::DecryptIfNecessary(Entry* entry) {
-  if (GetIsFolder()) return true;  // Ignore the top-level password folder.
-  const sync_pb::EntitySpecifics& specifics =
-      entry->Get(syncable::SPECIFICS);
-  if (specifics.HasExtension(sync_pb::password)) {
-    const sync_pb::EncryptedData& encrypted =
-        specifics.GetExtension(sync_pb::password).encrypted();
-    scoped_ptr<sync_pb::PasswordSpecificsData> data(
-        new sync_pb::PasswordSpecificsData);
-    if (!GetTransaction()->GetCryptographer()->Decrypt(encrypted,
-                                                       data.get()))
-      return false;
-    password_data_.swap(data);
-  }
-  return true;
-}
-
 int64 BaseNode::GetParentId() const {
   return IdToMetahandle(GetTransaction()->GetWrappedTrans(),
                         GetEntry()->Get(syncable::PARENT_ID));
@@ -270,10 +248,13 @@ const sync_pb::NigoriSpecifics& BaseNode::GetNigoriSpecifics() const {
   return GetEntry()->Get(SPECIFICS).GetExtension(sync_pb::nigori);
 }
 
-const sync_pb::PasswordSpecificsData& BaseNode::GetPasswordSpecifics() const {
+bool BaseNode::GetPasswordSpecifics(sync_pb::PasswordSpecificsData* data)
+    const {
   DCHECK(GetModelType() == syncable::PASSWORDS);
-  DCHECK(password_data_.get());
-  return *password_data_;
+  DCHECK(data);
+  const sync_pb::PasswordSpecifics& specifics =
+      GetEntry()->Get(SPECIFICS).GetExtension(sync_pb::password);
+  return data->ParseFromString(specifics.blob());
 }
 
 const sync_pb::PreferenceSpecifics& BaseNode::GetPreferenceSpecifics() const {
@@ -374,11 +355,7 @@ void WriteNode::SetPasswordSpecifics(
   std::string serialized_data;
   data.SerializeToString(&serialized_data);
   sync_pb::PasswordSpecifics new_value;
-  if (!GetTransaction()->GetCryptographer()->Encrypt(
-      data,
-      new_value.mutable_encrypted()))
-    NOTREACHED();
-
+  new_value.set_blob(serialized_data);
   PutPasswordSpecificsAndMarkForSyncing(new_value);
 }
 
@@ -473,8 +450,7 @@ bool WriteNode::InitByIdLookup(int64 id) {
   DCHECK_NE(id, kInvalidId);
   entry_ = new syncable::MutableEntry(transaction_->GetWrappedWriteTrans(),
                                       syncable::GET_BY_HANDLE, id);
-  return (entry_->good() && !entry_->Get(syncable::IS_DEL) &&
-          DecryptIfNecessary(entry_));
+  return (entry_->good() && !entry_->Get(syncable::IS_DEL));
 }
 
 // Find a node by client tag, and bind this WriteNode to it.
@@ -490,8 +466,7 @@ bool WriteNode::InitByClientTagLookup(syncable::ModelType model_type,
 
   entry_ = new syncable::MutableEntry(transaction_->GetWrappedWriteTrans(),
                                       syncable::GET_BY_CLIENT_TAG, hash);
-  return (entry_->good() && !entry_->Get(syncable::IS_DEL) &&
-          DecryptIfNecessary(entry_));
+  return (entry_->good() && !entry_->Get(syncable::IS_DEL));
 }
 
 bool WriteNode::InitByTagLookup(const std::string& tag) {
@@ -727,7 +702,7 @@ bool ReadNode::InitByIdLookup(int64 id) {
   LOG_IF(WARNING, model_type == syncable::UNSPECIFIED ||
                   model_type == syncable::TOP_LEVEL_FOLDER)
       << "SyncAPI InitByIdLookup referencing unusual object.";
-  return DecryptIfNecessary(entry_);
+  return true;
 }
 
 bool ReadNode::InitByClientTagLookup(syncable::ModelType model_type,
@@ -740,8 +715,7 @@ bool ReadNode::InitByClientTagLookup(syncable::ModelType model_type,
 
   entry_ = new syncable::Entry(transaction_->GetWrappedTrans(),
                                syncable::GET_BY_CLIENT_TAG, hash);
-  return (entry_->good() && !entry_->Get(syncable::IS_DEL) &&
-          DecryptIfNecessary(entry_));
+  return (entry_->good() && !entry_->Get(syncable::IS_DEL));
 }
 
 const syncable::Entry* ReadNode::GetEntry() const {
@@ -766,7 +740,7 @@ bool ReadNode::InitByTagLookup(const std::string& tag) {
   LOG_IF(WARNING, model_type == syncable::UNSPECIFIED ||
                   model_type == syncable::TOP_LEVEL_FOLDER)
       << "SyncAPI InitByTagLookup referencing unusually typed object.";
-  return DecryptIfNecessary(entry_);
+  return true;
 }
 
 //////////////////////////////////////////////////////////////////////////
@@ -916,8 +890,6 @@ class SyncManager::SyncInternal
   // Tell the sync engine to start the syncing process.
   void StartSyncing();
 
-  void SetPassphrase(const std::string& passphrase);
-
   // Call periodically from a database-safe thread to persist recent changes
   // to the syncapi model.
   void SaveChanges();
@@ -1242,10 +1214,6 @@ void SyncManager::StartSyncing() {
   data_->StartSyncing();
 }
 
-void SyncManager::SetPassphrase(const std::string& passphrase) {
-  data_->SetPassphrase(passphrase);
-}
-
 bool SyncManager::RequestPause() {
   return data_->syncer_thread()->RequestPause();
 }
@@ -1501,25 +1469,6 @@ void SyncManager::SyncInternal::RaiseAuthNeededEvent() {
     observer_->OnAuthError(AuthError(auth_problem_));
 }
 
-void SyncManager::SyncInternal::SetPassphrase(
-    const std::string& passphrase) {
-  Cryptographer* cryptographer = dir_manager()->cryptographer();
-  KeyParams params = {"localhost", "dummy", passphrase};
-  if (cryptographer->has_pending_keys()) {
-    if (!cryptographer->DecryptPendingKeys(params)) {
-      observer_->OnPassphraseRequired();
-      return;
-    }
-    // Nudge the syncer so that passwords updates that were waiting for this
-    // passphrase get applied as soon as possible.
-    sync_manager_->RequestNudge();
-  } else {
-    cryptographer->AddKey(params);
-    // TODO(albertb): Update the Nigori node on the server with the new keys.
-  }
-  observer_->OnPassphraseAccepted();
-}
-
 SyncManager::~SyncManager() {
   delete data_;
 }
@@ -1805,6 +1754,7 @@ void SyncManager::SyncInternal::HandleChannelEvent(const SyncerEvent& event) {
     // download; if so, we should signal that initialization is complete.
     if (event.snapshot->is_share_usable)
       MarkAndNotifyInitializationComplete();
+    return;
   }
 
   if (!observer_)
@@ -1818,38 +1768,6 @@ void SyncManager::SyncInternal::HandleChannelEvent(const SyncerEvent& event) {
   // Notifications are sent at the end of every sync cycle, regardless of
   // whether we should sync again.
   if (event.what_happened == SyncerEvent::SYNC_CYCLE_ENDED) {
-
-    ModelSafeRoutingInfo enabled_types;
-    registrar_->GetModelSafeRoutingInfo(&enabled_types);
-    if (enabled_types.count(syncable::PASSWORDS) > 0) {
-      Cryptographer* cryptographer =
-          GetUserShare()->dir_manager->cryptographer();
-      if (!cryptographer->is_ready() && !cryptographer->has_pending_keys()) {
-        sync_api::ReadTransaction trans(GetUserShare());
-        sync_api::ReadNode node(&trans);
-        if (!node.InitByTagLookup(kNigoriTag)) {
-          NOTREACHED();
-          return;
-        }
-        const sync_pb::NigoriSpecifics& nigori = node.GetNigoriSpecifics();
-        if (!nigori.encrypted().blob().empty()) {
-          if (cryptographer->CanDecrypt(nigori.encrypted())) {
-            cryptographer->SetKeys(nigori.encrypted());
-          } else {
-            cryptographer->SetPendingKeys(nigori.encrypted());
-          }
-        }
-      }
-      // If we've completed a sync cycle and the cryptographer isn't ready yet,
-      // prompt the user for a passphrase.
-      if (!cryptographer->is_ready()) {
-        observer_->OnPassphraseRequired();
-      }
-    }
-
-    if (!initialized())
-      return;
-
     if (!event.snapshot->has_more_to_sync) {
       observer_->OnSyncCycleCompleted(event.snapshot);
     }
@@ -2092,8 +2010,7 @@ BaseTransaction::BaseTransaction(UserShare* share)
     : lookup_(NULL) {
   DCHECK(share && share->dir_manager.get());
   lookup_ = new syncable::ScopedDirLookup(share->dir_manager.get(),
-                                          share->authenticated_name);
-  cryptographer_ = share->dir_manager->cryptographer();
+                                        share->authenticated_name);
   if (!(lookup_->good()))
     DCHECK(false) << "ScopedDirLookup failed on valid DirManager.";
 }
diff --git a/chrome/browser/sync/engine/syncapi.h b/chrome/browser/sync/engine/syncapi.h
index 88b2f0b..d7b984f 100644
--- a/chrome/browser/sync/engine/syncapi.h
+++ b/chrome/browser/sync/engine/syncapi.h
@@ -49,7 +49,6 @@
 #include "chrome/browser/google_service_auth_error.h"
 #include "chrome/browser/sync/notification_method.h"
 #include "chrome/browser/sync/syncable/model_type.h"
-#include "chrome/browser/sync/util/cryptographer.h"
 #include "googleurl/src/gurl.h"
 
 namespace browser_sync {
@@ -188,7 +187,7 @@ class BaseNode {
 
   // Getter specific to the PASSWORD datatype.  Returns protobuf
   // data.  Can only be called if GetModelType() == PASSWORD.
-  const sync_pb::PasswordSpecificsData& GetPasswordSpecifics() const;
+  bool GetPasswordSpecifics(sync_pb::PasswordSpecificsData*) const;
 
   // Getter specific to the PREFERENCE datatype.  Returns protobuf
   // data.  Can only be called if GetModelType() == PREFERENCE.
@@ -233,19 +232,10 @@ class BaseNode {
   static std::string GenerateSyncableHash(syncable::ModelType model_type,
       const std::string& client_tag);
 
-  // Determines whether part of the entry is encrypted, and if so attempts to
-  // decrypt it. Unless decryption is necessary and fails, this will always
-  // return |true|.
-  bool DecryptIfNecessary(syncable::Entry* entry);
-
  private:
   // Node is meant for stack use only.
   void* operator new(size_t size);
 
-  // If this node represents a password, this field will hold the actual
-  // decrypted password data.
-  scoped_ptr<sync_pb::PasswordSpecificsData> password_data_;
-
   friend class SyncApiTest;
   FRIEND_TEST_ALL_PREFIXES(SyncApiTest, GenerateSyncableHash);
 
@@ -452,9 +442,6 @@ class BaseTransaction {
   // Provide access to the underlying syncable.h objects from BaseNode.
   virtual syncable::BaseTransaction* GetWrappedTrans() const = 0;
   const syncable::ScopedDirLookup& GetLookup() const { return *lookup_; }
-  browser_sync::Cryptographer* GetCryptographer() const {
-    return cryptographer_;
-  }
 
  protected:
   // The ScopedDirLookup is created in the constructor and destroyed
@@ -467,8 +454,6 @@ class BaseTransaction {
   // A syncable ScopedDirLookup, which is the parent of syncable transactions.
   syncable::ScopedDirLookup* lookup_;
 
-  browser_sync::Cryptographer* cryptographer_;
-
   DISALLOW_COPY_AND_ASSIGN(BaseTransaction);
 };
 
@@ -671,13 +656,6 @@ class SyncManager {
     // Called when user interaction may be required due to an auth problem.
     virtual void OnAuthError(const GoogleServiceAuthError& auth_error) = 0;
 
-    // Called when user interaction is required to obtain a valid passphrase.
-    virtual void OnPassphraseRequired() = 0;
-
-    // Called when the passphrase provided by the user has been accepted and is
-    // now used to encrypt sync data.
-    virtual void OnPassphraseAccepted() = 0;
-
     // Called when initialization is complete to the point that SyncManager can
     // process changes. This does not necessarily mean authentication succeeded
     // or that the SyncManager is online.
@@ -774,15 +752,6 @@ class SyncManager {
   // Start the SyncerThread.
   void StartSyncing();
 
-  // Attempt to set the passphrase. If the passphrase is valid,
-  // OnPassphraseAccepted will be fired to notify the ProfileSyncService and the
-  // syncer will be nudged so that any update that was waiting for this
-  // passphrase gets applied as soon as possible.
-  // If the passphrase in invalid, OnPassphraseRequired will be fired.
-  // Calling this metdod again is the appropriate course of action to "retry"
-  // with a new passphrase.
-  void SetPassphrase(const std::string& passphrase);
-
   // Requests the syncer thread to pause.  The observer's OnPause
   // method will be called when the syncer thread is paused.  Returns
   // false if the syncer thread can not be paused (e.g. if it is not
diff --git a/chrome/browser/sync/engine/syncapi_unittest.cc b/chrome/browser/sync/engine/syncapi_unittest.cc
index a77134b..70157b5 100644
--- a/chrome/browser/sync/engine/syncapi_unittest.cc
+++ b/chrome/browser/sync/engine/syncapi_unittest.cc
@@ -9,15 +9,12 @@
 #include "base/scoped_ptr.h"
 #include "base/scoped_temp_dir.h"
 #include "chrome/browser/sync/engine/syncapi.h"
-#include "chrome/browser/sync/protocol/password_specifics.pb.h"
 #include "chrome/browser/sync/syncable/directory_manager.h"
 #include "chrome/browser/sync/syncable/syncable.h"
 #include "chrome/test/sync/engine/test_directory_setter_upper.h"
 
 #include "testing/gtest/include/gtest/gtest.h"
 
-using browser_sync::KeyParams;
-
 namespace sync_api {
 
 class SyncApiTest : public testing::Test {
@@ -235,33 +232,4 @@ TEST_F(SyncApiTest, TestDeleteBehavior) {
   }
 }
 
-TEST_F(SyncApiTest, WriteAndReadPassword) {
-  KeyParams params = {"localhost", "username", "passphrase"};
-  share_.dir_manager->cryptographer()->AddKey(params);
-  {
-    WriteTransaction trans(&share_);
-    ReadNode root_node(&trans);
-    root_node.InitByRootLookup();
-
-    WriteNode password_node(&trans);
-    EXPECT_TRUE(password_node.InitUniqueByCreation(syncable::PASSWORDS,
-                                                   root_node, "foo"));
-    sync_pb::PasswordSpecificsData data;
-    data.set_password_value("secret");
-    password_node.SetPasswordSpecifics(data);
-  }
-  {
-    ReadTransaction trans(&share_);
-    ReadNode root_node(&trans);
-    root_node.InitByRootLookup();
-
-    ReadNode password_node(&trans);
-    EXPECT_TRUE(password_node.InitByClientTagLookup(syncable::PASSWORDS,
-                                                    "foo"));
-    const sync_pb::PasswordSpecificsData& data =
-        password_node.GetPasswordSpecifics();
-    EXPECT_EQ("secret", data.password_value());
-  }
-}
-
 }  // namespace browser_sync
diff --git a/chrome/browser/sync/engine/syncer_util.cc b/chrome/browser/sync/engine/syncer_util.cc
index 41181d6..66fc52f 100644
--- a/chrome/browser/sync/engine/syncer_util.cc
+++ b/chrome/browser/sync/engine/syncer_util.cc
@@ -13,8 +13,6 @@
 #include "chrome/browser/sync/engine/syncer_types.h"
 #include "chrome/browser/sync/engine/syncproto.h"
 #include "chrome/browser/sync/protocol/bookmark_specifics.pb.h"
-#include "chrome/browser/sync/protocol/nigori_specifics.pb.h"
-#include "chrome/browser/sync/protocol/sync.pb.h"
 #include "chrome/browser/sync/syncable/directory_manager.h"
 #include "chrome/browser/sync/syncable/model_type.h"
 #include "chrome/browser/sync/syncable/syncable.h"
@@ -249,8 +247,7 @@ void SyncerUtil::AttemptReuniteLostCommitResponses(
 UpdateAttemptResponse SyncerUtil::AttemptToUpdateEntry(
     syncable::WriteTransaction* const trans,
     syncable::MutableEntry* const entry,
-    ConflictResolver* resolver,
-    Cryptographer* cryptographer) {
+    ConflictResolver* resolver) {
 
   CHECK(entry->good());
   if (!entry->Get(IS_UNAPPLIED_UPDATE))
@@ -292,33 +289,6 @@ UpdateAttemptResponse SyncerUtil::AttemptToUpdateEntry(
     }
   }
 
-  // We intercept updates to the Nigori node and update the Cryptographer here
-  // because there is no Nigori ChangeProcessor.
-  const sync_pb::EntitySpecifics& specifics = entry->Get(SERVER_SPECIFICS);
-  if (specifics.HasExtension(sync_pb::nigori)) {
-    const sync_pb::NigoriSpecifics& nigori =
-        specifics.GetExtension(sync_pb::nigori);
-    if (!nigori.encrypted().blob().empty()) {
-      if (cryptographer->CanDecrypt(nigori.encrypted())) {
-        cryptographer->SetKeys(nigori.encrypted());
-      } else {
-        cryptographer->SetPendingKeys(nigori.encrypted());
-      }
-    }
-  }
-
-  // Only apply updates that we can decrypt. Updates that can't be decrypted yet
-  // will stay in conflict until the user provides a passphrase that lets the
-  // Cryptographer decrypt them.
-  if (!entry->Get(SERVER_IS_DIR) && specifics.HasExtension(sync_pb::password)) {
-    const sync_pb::PasswordSpecifics& password =
-        specifics.GetExtension(sync_pb::password);
-    if (!cryptographer->CanDecrypt(password.encrypted())) {
-      // We can't decrypt this node yet.
-      return CONFLICT;
-    }
-  }
-
   SyncerUtil::UpdateLocalDataFromServerData(trans, entry);
 
   return SUCCESS;
@@ -735,8 +705,7 @@ VerifyResult SyncerUtil::VerifyUpdateConsistency(
       } else {
         LOG(ERROR) << "Server update doesn't agree with previous updates. ";
         LOG(ERROR) << " Entry: " << *same_id;
-        LOG(ERROR) << " Update: "
-                   << SyncerProtoUtil::SyncEntityDebugString(entry);
+        LOG(ERROR) << " Update: " << SyncerProtoUtil::SyncEntityDebugString(entry);
         return VERIFY_FAIL;
       }
     }
@@ -762,8 +731,7 @@ VerifyResult SyncerUtil::VerifyUpdateConsistency(
         model_type != same_id->GetModelType()) {
       LOG(ERROR) << "Server update doesn't agree with committed item. ";
       LOG(ERROR) << " Entry: " << *same_id;
-      LOG(ERROR) << " Update: "
-                 << SyncerProtoUtil::SyncEntityDebugString(entry);
+      LOG(ERROR) << " Update: " << SyncerProtoUtil::SyncEntityDebugString(entry);
       return VERIFY_FAIL;
     }
     if (same_id->Get(BASE_VERSION) == entry.version() &&
@@ -779,8 +747,7 @@ VerifyResult SyncerUtil::VerifyUpdateConsistency(
     if (same_id->Get(SERVER_VERSION) > entry.version()) {
       LOG(WARNING) << "We've already seen a more recent update from the server";
       LOG(WARNING) << " Entry: " << *same_id;
-      LOG(WARNING) << " Update: "
-                   << SyncerProtoUtil::SyncEntityDebugString(entry);
+      LOG(WARNING) << " Update: " << SyncerProtoUtil::SyncEntityDebugString(entry);
       return VERIFY_SKIP;
     }
   }
diff --git a/chrome/browser/sync/engine/syncer_util.h b/chrome/browser/sync/engine/syncer_util.h
index 809a931..134f7b7 100644
--- a/chrome/browser/sync/engine/syncer_util.h
+++ b/chrome/browser/sync/engine/syncer_util.h
@@ -21,7 +21,6 @@
 
 namespace browser_sync {
 
-class Cryptographer;
 class SyncEntity;
 
 class SyncerUtil {
@@ -54,8 +53,8 @@ class SyncerUtil {
   static UpdateAttemptResponse AttemptToUpdateEntry(
       syncable::WriteTransaction* const trans,
       syncable::MutableEntry* const entry,
-      ConflictResolver* resolver,
-      Cryptographer* cryptographer);
+      ConflictResolver* resolver);
+
 
   // Pass in name to avoid redundant UTF8 conversion.
   static void UpdateServerFieldsFromUpdate(
diff --git a/chrome/browser/sync/engine/update_applicator.cc b/chrome/browser/sync/engine/update_applicator.cc
index a174370..bcab9d4 100644
--- a/chrome/browser/sync/engine/update_applicator.cc
+++ b/chrome/browser/sync/engine/update_applicator.cc
@@ -17,13 +17,11 @@ using std::vector;
 namespace browser_sync {
 
 UpdateApplicator::UpdateApplicator(ConflictResolver* resolver,
-                                   Cryptographer* cryptographer,
                                    const UpdateIterator& begin,
                                    const UpdateIterator& end,
                                    const ModelSafeRoutingInfo& routes,
                                    ModelSafeGroup group_filter)
     : resolver_(resolver),
-      cryptographer_(cryptographer),
       begin_(begin),
       end_(end),
       pointer_(begin),
@@ -60,8 +58,8 @@ bool UpdateApplicator::AttemptOneApplication(
   }
 
   syncable::MutableEntry entry(trans, syncable::GET_BY_HANDLE, *pointer_);
-  UpdateAttemptResponse updateResponse = SyncerUtil::AttemptToUpdateEntry(
-      trans, &entry, resolver_, cryptographer_);
+  UpdateAttemptResponse updateResponse =
+      SyncerUtil::AttemptToUpdateEntry(trans, &entry, resolver_);
   switch (updateResponse) {
     case SUCCESS:
       Advance();
diff --git a/chrome/browser/sync/engine/update_applicator.h b/chrome/browser/sync/engine/update_applicator.h
index eb8b97c..7073f0a 100644
--- a/chrome/browser/sync/engine/update_applicator.h
+++ b/chrome/browser/sync/engine/update_applicator.h
@@ -27,7 +27,6 @@ class UpdateProgress;
 }
 
 class ConflictResolver;
-class Cryptographer;
 
 class UpdateApplicator {
  public:
@@ -35,7 +34,6 @@ class UpdateApplicator {
       UpdateIterator;
 
   UpdateApplicator(ConflictResolver* resolver,
-                   Cryptographer* cryptographer,
                    const UpdateIterator& begin,
                    const UpdateIterator& end,
                    const ModelSafeRoutingInfo& routes,
@@ -64,9 +62,6 @@ class UpdateApplicator {
   // Used to resolve conflicts when trying to apply updates.
   ConflictResolver* const resolver_;
 
-  // Used to decrypt sensitive sync nodes.
-  Cryptographer* cryptographer_;
-
   UpdateIterator const begin_;
   UpdateIterator end_;
   UpdateIterator pointer_;
diff --git a/chrome/browser/sync/glue/password_change_processor.cc b/chrome/browser/sync/glue/password_change_processor.cc
index 93143e6..a860ae0 100644
--- a/chrome/browser/sync/glue/password_change_processor.cc
+++ b/chrome/browser/sync/glue/password_change_processor.cc
@@ -153,8 +153,12 @@ void PasswordChangeProcessor::ApplyChangesFromSyncModel(
     DCHECK(password_root.GetId() == sync_node.GetParentId());
     DCHECK(syncable::PASSWORDS == sync_node.GetModelType());
 
-    const sync_pb::PasswordSpecificsData& password_data =
-        sync_node.GetPasswordSpecifics();
+    sync_pb::PasswordSpecificsData password_data;
+    if (!sync_node.GetPasswordSpecifics(&password_data)) {
+      error_handler()->OnUnrecoverableError(FROM_HERE,
+          "Could not read password specifics");
+      return;
+    }
     webkit_glue::PasswordForm password;
     PasswordModelAssociator::CopyPassword(password_data,
                                           &password);
diff --git a/chrome/browser/sync/glue/password_model_associator.cc b/chrome/browser/sync/glue/password_model_associator.cc
index e4d2e05..6eaa7a7 100644
--- a/chrome/browser/sync/glue/password_model_associator.cc
+++ b/chrome/browser/sync/glue/password_model_associator.cc
@@ -73,8 +73,12 @@ bool PasswordModelAssociator::AssociateModels() {
 
     sync_api::ReadNode node(&trans);
     if (node.InitByClientTagLookup(syncable::PASSWORDS, tag)) {
-      const sync_pb::PasswordSpecificsData& password =
-          node.GetPasswordSpecifics();
+      sync_pb::PasswordSpecificsData password;
+      if (!node.GetPasswordSpecifics(&password)) {
+        STLDeleteElements(&passwords);
+        LOG(ERROR) << "Failed to get password specifics from sync node.";
+        return false;
+      }
       DCHECK_EQ(tag, MakeTag(password));
 
       webkit_glue::PasswordForm new_password;
@@ -117,8 +121,11 @@ bool PasswordModelAssociator::AssociateModels() {
       LOG(ERROR) << "Failed to fetch child node.";
       return false;
     }
-    const sync_pb::PasswordSpecificsData& password =
-        sync_child_node.GetPasswordSpecifics();
+    sync_pb::PasswordSpecificsData password;
+    if (!sync_child_node.GetPasswordSpecifics(&password)) {
+      LOG(ERROR) << "Failed to get specifics from password node.";
+      return false;
+    }
     std::string tag = MakeTag(password);
 
     // The password only exists on the server.  Add it to the local
diff --git a/chrome/browser/sync/glue/sync_backend_host.cc b/chrome/browser/sync/glue/sync_backend_host.cc
index 0c36f3d..d765273e 100644
--- a/chrome/browser/sync/glue/sync_backend_host.cc
+++ b/chrome/browser/sync/glue/sync_backend_host.cc
@@ -101,7 +101,6 @@ void SyncBackendHost::Initialize(
       it != types.end(); ++it) {
     registrar_.routing_info[(*it)] = GROUP_PASSIVE;
   }
-  registrar_.routing_info[syncable::NIGORI] = GROUP_PASSIVE;
 
   core_thread_.message_loop()->PostTask(FROM_HERE,
       NewRunnableMethod(core_.get(), &SyncBackendHost::Core::DoInitialize,
@@ -130,12 +129,6 @@ void SyncBackendHost::StartSyncing() {
       NewRunnableMethod(core_.get(), &SyncBackendHost::Core::DoStartSyncing));
 }
 
-void SyncBackendHost::SetPassphrase(const std::string& passphrase) {
-  core_thread_.message_loop()->PostTask(FROM_HERE,
-      NewRunnableMethod(core_.get(), &SyncBackendHost::Core::DoSetPassphrase,
-                        passphrase));
-}
-
 void SyncBackendHost::Shutdown(bool sync_disabled) {
   // Thread shutdown should occur in the following order:
   // - SyncerThread
@@ -282,20 +275,6 @@ void SyncBackendHost::Core::NotifyResumed() {
                                          NotificationService::NoDetails());
 }
 
-void SyncBackendHost::Core::NotifyPassphraseRequired() {
-  NotificationService::current()->Notify(
-      NotificationType::SYNC_PASSPHRASE_REQUIRED,
-      NotificationService::AllSources(),
-      NotificationService::NoDetails());
-}
-
-void SyncBackendHost::Core::NotifyPassphraseAccepted() {
-  NotificationService::current()->Notify(
-      NotificationType::SYNC_PASSPHRASE_ACCEPTED,
-      NotificationService::AllSources(),
-      NotificationService::NoDetails());
-}
-
 SyncBackendHost::UserShareHandle SyncBackendHost::GetUserShareHandle() const {
   return core_->syncapi()->GetUserShare();
 }
@@ -421,11 +400,6 @@ void SyncBackendHost::Core::DoStartSyncing() {
   syncapi_->StartSyncing();
 }
 
-void SyncBackendHost::Core::DoSetPassphrase(const std::string& passphrase) {
-  DCHECK(MessageLoop::current() == host_->core_thread_.message_loop());
-  syncapi_->SetPassphrase(passphrase);
-}
-
 UIModelWorker* SyncBackendHost::ui_worker() {
   ModelSafeWorker* w = registrar_.workers[GROUP_UI];
   if (w == NULL)
@@ -569,16 +543,6 @@ void SyncBackendHost::Core::OnAuthError(const AuthError& auth_error) {
       auth_error));
 }
 
-void SyncBackendHost::Core::OnPassphraseRequired() {
-  host_->frontend_loop_->PostTask(FROM_HERE,
-      NewRunnableMethod(this, &Core::NotifyPassphraseRequired));
-}
-
-void SyncBackendHost::Core::OnPassphraseAccepted() {
-  host_->frontend_loop_->PostTask(FROM_HERE,
-      NewRunnableMethod(this, &Core::NotifyPassphraseAccepted));
-}
-
 void SyncBackendHost::Core::OnPaused() {
   host_->frontend_loop_->PostTask(
       FROM_HERE,
diff --git a/chrome/browser/sync/glue/sync_backend_host.h b/chrome/browser/sync/glue/sync_backend_host.h
index be20013..fc9fa31 100644
--- a/chrome/browser/sync/glue/sync_backend_host.h
+++ b/chrome/browser/sync/glue/sync_backend_host.h
@@ -116,9 +116,6 @@ class SyncBackendHost : public browser_sync::ModelSafeWorkerRegistrar {
   // Called on |frontend_loop_| to start syncing.
   void StartSyncing();
 
-  // Called on |frontend_loop_| to asynchronously set the passphrase.
-  void SetPassphrase(const std::string& passphrase);
-
   // Called on |frontend_loop_| to kick off shutdown.
   // |sync_disabled| indicates if syncing is being disabled or not.
   // See the implementation and Core::DoShutdown for details.
@@ -194,7 +191,6 @@ class SyncBackendHost : public browser_sync::ModelSafeWorkerRegistrar {
     registrar_.routing_info[syncable::AUTOFILL] = GROUP_PASSIVE;
     registrar_.routing_info[syncable::THEMES] = GROUP_PASSIVE;
     registrar_.routing_info[syncable::TYPED_URLS] = GROUP_PASSIVE;
-    registrar_.routing_info[syncable::NIGORI] = GROUP_PASSIVE;
     registrar_.routing_info[syncable::PASSWORDS] = GROUP_PASSIVE;
 
     core_thread_.message_loop()->PostTask(FROM_HERE,
@@ -228,8 +224,6 @@ class SyncBackendHost : public browser_sync::ModelSafeWorkerRegistrar {
         const sessions::SyncSessionSnapshot* snapshot);
     virtual void OnInitializationComplete();
     virtual void OnAuthError(const GoogleServiceAuthError& auth_error);
-    virtual void OnPassphraseRequired();
-    virtual void OnPassphraseAccepted();
     virtual void OnPaused();
     virtual void OnResumed();
 
@@ -290,10 +284,6 @@ class SyncBackendHost : public browser_sync::ModelSafeWorkerRegistrar {
     // syncing (generally after initialization and authentication).
     void DoStartSyncing();
 
-    // Called on our SyncBackendHost's |core_thread_| to set the passphrase
-    // on behalf of SyncBackendHost::SupplyPassphrase.
-    void DoSetPassphrase(const std::string& passphrase);
-
     // The shutdown order is a bit complicated:
     // 1) From |core_thread_|, invoke the syncapi Shutdown call to do a final
     //    SaveChanges, close sqlite handles, and halt the syncer thread (which
@@ -370,12 +360,6 @@ class SyncBackendHost : public browser_sync::ModelSafeWorkerRegistrar {
     void HandleAuthErrorEventOnFrontendLoop(
         const GoogleServiceAuthError& new_auth_error);
 
-    // Invoked when a passphrase is required to decrypt a set of Nigori keys.
-    void NotifyPassphraseRequired();
-
-    // Invoked when the passphrase provided by the user has been accepted.
-    void NotifyPassphraseAccepted();
-
     // Called from Core::OnSyncCycleCompleted to handle updating frontend
     // thread components.
     void HandleSyncCycleCompletedOnFrontendLoop(
diff --git a/chrome/browser/sync/profile_sync_service.cc b/chrome/browser/sync/profile_sync_service.cc
index 7b4f3fb..7e53ba1 100644
--- a/chrome/browser/sync/profile_sync_service.cc
+++ b/chrome/browser/sync/profile_sync_service.cc
@@ -27,7 +27,6 @@
 #include "chrome/browser/sync/glue/data_type_controller.h"
 #include "chrome/browser/sync/glue/data_type_manager.h"
 #include "chrome/browser/sync/profile_sync_factory.h"
-#include "chrome/browser/sync/syncable/directory_manager.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/notification_details.h"
 #include "chrome/common/notification_service.h"
@@ -79,12 +78,6 @@ ProfileSyncService::ProfileSyncService(
   registrar_.Add(this,
                  NotificationType::SYNC_CONFIGURE_DONE,
                  NotificationService::AllSources());
-  registrar_.Add(this,
-                 NotificationType::SYNC_PASSPHRASE_REQUIRED,
-                 NotificationService::AllSources());
-  registrar_.Add(this,
-                 NotificationType::SYNC_PASSPHRASE_ACCEPTED,
-                 NotificationService::AllSources());
 
   // By default, dev & chromium users will go to the development servers.
   // Dev servers have more features than standard sync servers.
@@ -657,12 +650,8 @@ void ProfileSyncService::GetRegisteredDataTypes(
 }
 
 bool ProfileSyncService::IsCryptographerReady() const {
-  return backend_->GetUserShareHandle()->
-      dir_manager->cryptographer()->is_ready();
-}
-
-void ProfileSyncService::SetPassphrase(const std::string& passphrase) {
-  backend_->SetPassphrase(passphrase);
+  // TODO(albertb): Replace this once the crypto patch lands.
+  return true;
 }
 
 void ProfileSyncService::StartProcessingChangesIfReady() {
@@ -721,21 +710,6 @@ void ProfileSyncService::Observe(NotificationType type,
       FOR_EACH_OBSERVER(Observer, observers_, OnStateChanged());
       break;
     }
-    case NotificationType::SYNC_PASSPHRASE_REQUIRED: {
-      // TODO(sync): Show the passphrase UI here.
-      SetPassphrase("dummy passphrase");
-      break;
-    }
-    case NotificationType::SYNC_PASSPHRASE_ACCEPTED: {
-      // Make sure the data types that depend on the passphrase are started at
-      // this time.
-      syncable::ModelTypeSet types;
-      GetPreferredDataTypes(&types);
-      data_type_manager_->Configure(types);
-
-      FOR_EACH_OBSERVER(Observer, observers_, OnStateChanged());
-      break;
-    }
     default: {
       NOTREACHED();
     }
diff --git a/chrome/browser/sync/profile_sync_service.h b/chrome/browser/sync/profile_sync_service.h
index 929d8bd..016b032 100644
--- a/chrome/browser/sync/profile_sync_service.h
+++ b/chrome/browser/sync/profile_sync_service.h
@@ -303,11 +303,6 @@ class ProfileSyncService : public browser_sync::SyncFrontend,
   // for sensitive data types.
   virtual bool IsCryptographerReady() const;
 
-  // Sets the Cryptographer's passphrase. This will check asynchronously whether
-  // the passphrase is valid and notify ProfileSyncServiceObservers via the
-  // NotificationService when the outcome is known.
-  virtual void SetPassphrase(const std::string& passphrase);
-
  protected:
   // Used by ProfileSyncServiceMock only.
   //
diff --git a/chrome/browser/sync/profile_sync_service_password_unittest.cc b/chrome/browser/sync/profile_sync_service_password_unittest.cc
index e285b06..89766ff 100644
--- a/chrome/browser/sync/profile_sync_service_password_unittest.cc
+++ b/chrome/browser/sync/profile_sync_service_password_unittest.cc
@@ -142,15 +142,11 @@ class ProfileSyncServicePasswordTest : public testing::Test {
 
       // State changes once for the backend init and once for startup done.
       EXPECT_CALL(observer_, OnStateChanged()).
-          WillOnce(Return()).
-          WillOnce(Return()).
-          WillOnce(Return()).
           WillOnce(InvokeTask(task)).
           WillOnce(Return()).
           WillOnce(QuitUIMessageLoop());
       service_->RegisterDataTypeController(data_type_controller);
       service_->Initialize();
-      service_->SetPassphrase("foo");
       MessageLoop::current()->Run();
     }
   }
@@ -205,8 +201,8 @@ class ProfileSyncServicePasswordTest : public testing::Test {
       sync_api::ReadNode child_node(&trans);
       ASSERT_TRUE(child_node.InitByIdLookup(child_id));
 
-      const sync_pb::PasswordSpecificsData& password =
-          child_node.GetPasswordSpecifics();
+      sync_pb::PasswordSpecificsData password;
+      ASSERT_TRUE(child_node.GetPasswordSpecifics(&password));
 
       PasswordForm form;
       PasswordModelAssociator::CopyPassword(password, &form);
@@ -292,8 +288,8 @@ class AddPasswordEntriesTask : public Task {
 TEST_F(ProfileSyncServicePasswordTest, FailModelAssociation) {
   // Backend will be paused but not resumed.
   EXPECT_CALL(backend_, RequestPause()).
-      WillRepeatedly(testing::DoAll(Notify(NotificationType::SYNC_PAUSED),
-                                    testing::Return(true)));
+      WillOnce(testing::DoAll(Notify(NotificationType::SYNC_PAUSED),
+                              testing::Return(true)));
   // Don't create the root password node so startup fails.
   StartSyncService(NULL);
   EXPECT_TRUE(service_->unrecoverable_error_detected());
diff --git a/chrome/browser/sync/protocol/password_specifics.proto b/chrome/browser/sync/protocol/password_specifics.proto
index efd3400b..4d1bc17 100644
--- a/chrome/browser/sync/protocol/password_specifics.proto
+++ b/chrome/browser/sync/protocol/password_specifics.proto
@@ -10,11 +10,10 @@ option optimize_for = LITE_RUNTIME;
 
 package sync_pb;
 
-import "encryption.proto";
 import "sync.proto";
 
-// These are the properties that get serialized into the |encrypted| field of
-// PasswordSpecifics.
+// These are the properties that get serialized into the |blob| field of
+// |PasswordSpecifics|.
 message PasswordSpecificsData {
   optional int32 scheme = 1;
   optional string signon_realm = 2;
@@ -30,10 +29,10 @@ message PasswordSpecificsData {
   optional bool blacklisted = 12;
 }
 
-// Properties of password sync objects. The actual password data is held in a
-// PasswordSpecificsData that is encrypted into |encrypted|.
+// Properties of password sync objects.
 message PasswordSpecifics {
-  optional EncryptedData encrypted = 1;
+  optional string key = 1;
+  optional string blob = 2;
 }
 
 extend EntitySpecifics {
diff --git a/chrome/browser/sync/syncable/directory_manager.cc b/chrome/browser/sync/syncable/directory_manager.cc
index 0719c67..96578c0 100644
--- a/chrome/browser/sync/syncable/directory_manager.cc
+++ b/chrome/browser/sync/syncable/directory_manager.cc
@@ -14,8 +14,6 @@
 #include "chrome/browser/sync/syncable/syncable.h"
 #include "chrome/common/deprecated/event_sys-inl.h"
 
-using browser_sync::Cryptographer;
-
 namespace syncable {
 
 static const FilePath::CharType kSyncDataDatabaseFilename[] =
@@ -39,8 +37,7 @@ const FilePath DirectoryManager::GetSyncDataDatabasePath() const {
 DirectoryManager::DirectoryManager(const FilePath& path)
     : root_path_(path),
       managed_directory_(NULL),
-      channel_(new Channel(DirectoryManagerShutdownEvent())),
-      cryptographer_(new Cryptographer) {
+      channel_(new Channel(DirectoryManagerShutdownEvent())) {
 }
 
 DirectoryManager::~DirectoryManager() {
diff --git a/chrome/browser/sync/syncable/directory_manager.h b/chrome/browser/sync/syncable/directory_manager.h
index 61f303e..7753b1b 100644
--- a/chrome/browser/sync/syncable/directory_manager.h
+++ b/chrome/browser/sync/syncable/directory_manager.h
@@ -22,7 +22,6 @@
 #include "chrome/browser/sync/syncable/dir_open_result.h"
 #include "chrome/browser/sync/syncable/path_name_cmp.h"
 #include "chrome/browser/sync/syncable/syncable.h"
-#include "chrome/browser/sync/util/cryptographer.h"
 #include "chrome/browser/sync/util/sync_types.h"
 #include "chrome/common/deprecated/event_sys.h"
 
@@ -77,10 +76,6 @@ class DirectoryManager {
 
   Channel* channel() const { return channel_; }
 
-  browser_sync::Cryptographer* cryptographer() const {
-    return cryptographer_.get();
-  }
-
  protected:
   DirOpenResult OpenImpl(const std::string& name, const FilePath& path,
                          bool* was_open);
@@ -96,9 +91,8 @@ class DirectoryManager {
 
   Channel* const channel_;
 
-  scoped_ptr<browser_sync::Cryptographer> cryptographer_;
-
  private:
+
   DISALLOW_COPY_AND_ASSIGN(DirectoryManager);
 };
 
diff --git a/chrome/browser/sync/syncable/model_type.cc b/chrome/browser/sync/syncable/model_type.cc
index a03a794..ea89bb1 100644
--- a/chrome/browser/sync/syncable/model_type.cc
+++ b/chrome/browser/sync/syncable/model_type.cc
@@ -122,10 +122,6 @@ std::string ModelTypeToString(ModelType model_type) {
       return "Typed URLs";
     case EXTENSIONS:
       return "Extensions";
-    case PASSWORDS:
-      return "Passwords";
-    case NIGORI:
-      return "Encryption keys";
     default:
       NOTREACHED() << "No known extension for model type.";
       return "INVALID";
diff --git a/chrome/browser/sync/util/cryptographer.cc b/chrome/browser/sync/util/cryptographer.cc
index f323d17..0fbaa3a 100644
--- a/chrome/browser/sync/util/cryptographer.cc
+++ b/chrome/browser/sync/util/cryptographer.cc
@@ -6,7 +6,7 @@
 
 namespace browser_sync {
 
-const char kNigoriTag[] = "google_chrome_nigori";
+const char kNigoriTag[] = "nigori";
 
 // We name a particular Nigori instance (ie. a triplet consisting of a hostname,
 // a username, and a password) by calling Permute on this string. Since the
@@ -14,7 +14,7 @@ const char kNigoriTag[] = "google_chrome_nigori";
 // assign the same name to a particular triplet.
 const char kNigoriKeyName[] = "nigori-key";
 
-Cryptographer::Cryptographer() : default_nigori_(NULL) {
+Cryptographer::Cryptographer() {
 }
 
 bool Cryptographer::CanDecrypt(const sync_pb::EncryptedData& data) const {
diff --git a/chrome/browser/sync/util/cryptographer.h b/chrome/browser/sync/util/cryptographer.h
index 0ffa84f..2d967fe 100644
--- a/chrome/browser/sync/util/cryptographer.h
+++ b/chrome/browser/sync/util/cryptographer.h
@@ -15,8 +15,6 @@
 
 namespace browser_sync {
 
-extern const char kNigoriTag[];
-
 // The parameters used to initialize a Nigori instance.
 struct KeyParams {
   std::string hostname;
diff --git a/chrome/chrome_tests.gypi b/chrome/chrome_tests.gypi
index 5063757..17ec36b 100755
--- a/chrome/chrome_tests.gypi
+++ b/chrome/chrome_tests.gypi
@@ -1298,7 +1298,6 @@
       'msvs_guid': 'D7589D0D-304E-4589-85A4-153B7D84B07F',
       'dependencies': [
         'browser',
-        'browser/sync/protocol/sync_proto.gyp:sync_proto_cpp',
         'chrome',
         'chrome_resources',
         'chrome_strings',
@@ -2057,7 +2056,6 @@
         ['OS=="linux"', {
            'dependencies': [
              '../build/linux/system.gyp:gtk',
-             '../build/linux/system.gyp:nss',
            ],
         }],
         ['OS=="win"', {
diff --git a/chrome/common/notification_type.h b/chrome/common/notification_type.h
index 464f629..93145d1 100644
--- a/chrome/common/notification_type.h
+++ b/chrome/common/notification_type.h
@@ -997,17 +997,6 @@ class NotificationType {
     // operations.
     SESSION_SERVICE_SAVED,
 
-    // The syncer requires a passphrase to decrypt sensitive updates. This
-    // notification is sent when the first sensitive data type is setup by the
-    // user as well as anytime any the passphrase is changed in another synced
-    // client.
-    SYNC_PASSPHRASE_REQUIRED,
-
-    // Sent when the passphrase provided by the user is accepted. After this
-    // notification is sent, updates to sensitive nodes are encrypted using the
-    // accepted passphrase.
-    SYNC_PASSPHRASE_ACCEPTED,
-
     // Cookies -----------------------------------------------------------------
 
     // Sent when a cookie changes. The source is a Profile object, the details
diff --git a/chrome/test/interactive_ui/interactive_ui_tests.gypi b/chrome/test/interactive_ui/interactive_ui_tests.gypi
index 8bf5dee..ae8dd87 100644
--- a/chrome/test/interactive_ui/interactive_ui_tests.gypi
+++ b/chrome/test/interactive_ui/interactive_ui_tests.gypi
@@ -10,7 +10,6 @@
     '<(DEPTH)/chrome/chrome.gyp:test_support_common',
     '<(DEPTH)/chrome/chrome.gyp:test_support_ui',
     '<(DEPTH)/chrome/chrome.gyp:syncapi',
-    '<(DEPTH)/chrome/browser/sync/protocol/sync_proto.gyp:sync_proto_cpp',
     '<(DEPTH)/third_party/hunspell/hunspell.gyp:hunspell',
     '<(DEPTH)/net/net.gyp:net_resources',
     '<(DEPTH)/net/net.gyp:net_test_support',