[Sync] Add custom passphrase time tracking

We now track when a custom passphrase is set, and in conjunction with
the migration time now support querying the passphrase time (returns
migration time for FROZEN_IMPLICIT type, or custom passphrase time for
CUSTOM_PASSPHRASE type).

Plumb this information up through to the PSS for eventual use in the UI.

BUG=129665


Review URL: https://chromiumcodereview.appspot.com/11098007

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@161478 0039d316-1c4b-4281-b951-d872f2087c98

12 files changed, 130 insertions, 43 deletions

diff --git a/sync/internal_api/debug_info_event_listener.cc b/sync/internal_api/debug_info_event_listener.cc
index 58eba87..273eeb5 100644
--- a/sync/internal_api/debug_info_event_listener.cc
+++ b/sync/internal_api/debug_info_event_listener.cc
@@ -101,7 +101,9 @@ void DebugInfoEventListener::OnCryptographerStateChanged(
   cryptographer_ready_ = cryptographer->is_ready();
 }
 
-void DebugInfoEventListener::OnPassphraseTypeChanged(PassphraseType type) {
+void DebugInfoEventListener::OnPassphraseTypeChanged(
+    PassphraseType type,
+    base::Time explicit_passphrase_time) {
   CreateAndAddEvent(sync_pb::DebugEventInfo::PASSPHRASE_TYPE_CHANGED);
 }
 
diff --git a/sync/internal_api/debug_info_event_listener.h b/sync/internal_api/debug_info_event_listener.h
index 451d23a9..8cbdb7b 100644
--- a/sync/internal_api/debug_info_event_listener.h
+++ b/sync/internal_api/debug_info_event_listener.h
@@ -58,7 +58,9 @@ class DebugInfoEventListener : public SyncManager::Observer,
   virtual void OnEncryptionComplete() OVERRIDE;
   virtual void OnCryptographerStateChanged(
       Cryptographer* cryptographer) OVERRIDE;
-  virtual void OnPassphraseTypeChanged(PassphraseType type) OVERRIDE;
+  virtual void OnPassphraseTypeChanged(
+      PassphraseType type,
+      base::Time explicit_passphrase_time) OVERRIDE;
 
   // Sync manager events.
   void OnNudgeFromDatatype(ModelType datatype);
diff --git a/sync/internal_api/js_sync_encryption_handler_observer.cc b/sync/internal_api/js_sync_encryption_handler_observer.cc
index e2b4082..d44bda7 100644
--- a/sync/internal_api/js_sync_encryption_handler_observer.cc
+++ b/sync/internal_api/js_sync_encryption_handler_observer.cc
@@ -16,6 +16,7 @@
 #include "sync/js/js_event_details.h"
 #include "sync/js/js_event_handler.h"
 #include "sync/util/cryptographer.h"
+#include "sync/util/time.h"
 
 namespace syncer {
 
@@ -98,13 +99,16 @@ void JsSyncEncryptionHandlerObserver::OnCryptographerStateChanged(
 }
 
 void JsSyncEncryptionHandlerObserver::OnPassphraseTypeChanged(
-    PassphraseType type) {
+    PassphraseType type,
+    base::Time explicit_passphrase_time) {
   if (!event_handler_.IsInitialized()) {
     return;
   }
   DictionaryValue details;
   details.SetString("passphraseType",
                     PassphraseTypeToString(type));
+  details.SetInteger("explicitPassphraseTime",
+                     TimeToProtoTime(explicit_passphrase_time));
   HandleJsEvent(FROM_HERE,
                 "onPassphraseTypeChanged",
                 JsEventDetails(&details));
diff --git a/sync/internal_api/js_sync_encryption_handler_observer.h b/sync/internal_api/js_sync_encryption_handler_observer.h
index 8e5dc21..39dfcd1 100644
--- a/sync/internal_api/js_sync_encryption_handler_observer.h
+++ b/sync/internal_api/js_sync_encryption_handler_observer.h
@@ -44,7 +44,9 @@ class JsSyncEncryptionHandlerObserver : public SyncEncryptionHandler::Observer {
   virtual void OnEncryptionComplete() OVERRIDE;
   virtual void OnCryptographerStateChanged(
       Cryptographer* cryptographer) OVERRIDE;
-  virtual void OnPassphraseTypeChanged(PassphraseType type) OVERRIDE;
+  virtual void OnPassphraseTypeChanged(
+      PassphraseType type,
+      base::Time explicit_passphrase_time) OVERRIDE;
 
  private:
   void HandleJsEvent(const tracked_objects::Location& from_here,
diff --git a/sync/internal_api/js_sync_encryption_handler_observer_unittest.cc b/sync/internal_api/js_sync_encryption_handler_observer_unittest.cc
index dc99328..f363de1 100644
--- a/sync/internal_api/js_sync_encryption_handler_observer_unittest.cc
+++ b/sync/internal_api/js_sync_encryption_handler_observer_unittest.cc
@@ -14,6 +14,7 @@
 #include "sync/js/js_event_details.h"
 #include "sync/js/js_test_util.h"
 #include "sync/util/cryptographer.h"
+#include "sync/util/time.h"
 #include "sync/test/fake_encryptor.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -158,12 +159,13 @@ TEST_F(JsSyncEncryptionHandlerObserverTest, OnPassphraseTypeChanged) {
 
   DictionaryValue passphrase_type_details;
   passphrase_type_details.SetString("passphraseType", "IMPLICIT_PASSPHRASE");
+  passphrase_type_details.SetInteger("explicitPassphraseTime", 10);
   EXPECT_CALL(mock_js_event_handler_,
               HandleJsEvent("onPassphraseTypeChanged",
                             HasDetailsAsDictionary(passphrase_type_details)));
 
   js_sync_encryption_handler_observer_.OnPassphraseTypeChanged(
-      IMPLICIT_PASSPHRASE);
+      IMPLICIT_PASSPHRASE, ProtoTimeToTime(10));
   PumpLoop();
 }
 
diff --git a/sync/internal_api/public/sync_encryption_handler.h b/sync/internal_api/public/sync_encryption_handler.h
index 1ed3bcd..d7be069 100644
--- a/sync/internal_api/public/sync_encryption_handler.h
+++ b/sync/internal_api/public/sync_encryption_handler.h
@@ -7,6 +7,7 @@
 
 #include <string>
 
+#include "base/time.h"
 #include "sync/internal_api/public/base/model_type.h"
 
 namespace sync_pb {
@@ -111,8 +112,12 @@ class SyncEncryptionHandler {
     // Used primarily for debugging.
     virtual void OnCryptographerStateChanged(Cryptographer* cryptographer) = 0;
 
-    // The passprhase state has changed.
-    virtual void OnPassphraseTypeChanged(PassphraseType type) = 0;
+    // The passphrase type has changed. |type| is the new type,
+    // |passphrase_time| is the time the passphrase was set (unset if |type|
+    // is KEYSTORE_PASSPHRASE or the passphrase was set before we started
+    // recording the time).
+    virtual void OnPassphraseTypeChanged(PassphraseType type,
+                                         base::Time passphrase_time) = 0;
 
    protected:
     virtual ~Observer();
diff --git a/sync/internal_api/sync_encryption_handler_impl.cc b/sync/internal_api/sync_encryption_handler_impl.cc
index 2f15348..c33951e 100644
--- a/sync/internal_api/sync_encryption_handler_impl.cc
+++ b/sync/internal_api/sync_encryption_handler_impl.cc
@@ -257,8 +257,11 @@ void SyncEncryptionHandlerImpl::SetEncryptionPassphrase(
         if (is_explicit) {
           DVLOG(1) << "Setting explicit passphrase for encryption.";
           passphrase_type_ = CUSTOM_PASSPHRASE;
+          custom_passphrase_time_ = base::Time::Now();
           FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                            OnPassphraseTypeChanged(passphrase_type_));
+                            OnPassphraseTypeChanged(
+                                passphrase_type_,
+                                GetExplicitPassphraseTime()));
         } else {
           DVLOG(1) << "Setting implicit passphrase for encryption.";
         }
@@ -597,6 +600,10 @@ base::Time SyncEncryptionHandlerImpl::migration_time() const {
   return migration_time_;
 }
 
+base::Time SyncEncryptionHandlerImpl::custom_passphrase_time() const {
+  return custom_passphrase_time_;
+}
+
 // This function iterates over all encrypted types.  There are many scenarios in
 // which data for some or all types is not currently available.  In that case,
 // the lookup of the root node will fail and we will skip encryption for that
@@ -675,6 +682,11 @@ bool SyncEncryptionHandlerImpl::ApplyNigoriUpdateImpl(
   DVLOG(1) << "Applying nigori node update.";
   bool nigori_types_need_update = !UpdateEncryptedTypesFromNigori(nigori,
                                                                   trans);
+
+  if (nigori.custom_passphrase_time() != 0) {
+    custom_passphrase_time_ =
+        ProtoTimeToTime(nigori.custom_passphrase_time());
+  }
   bool is_nigori_migrated = IsNigoriMigratedToKeystore(nigori);
   if (is_nigori_migrated) {
     DCHECK(nigori.has_keystore_migration_time());
@@ -700,7 +712,9 @@ bool SyncEncryptionHandlerImpl::ApplyNigoriUpdateImpl(
                << PassphraseTypeToString(nigori_passphrase_type);
       passphrase_type_ = nigori_passphrase_type;
       FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                        OnPassphraseTypeChanged(passphrase_type_));
+                            OnPassphraseTypeChanged(
+                                passphrase_type_,
+                                GetExplicitPassphraseTime()));
     }
     if (passphrase_type_ == KEYSTORE_PASSPHRASE && encrypt_everything_) {
       // This is the case where another client that didn't support keystore
@@ -713,7 +727,9 @@ bool SyncEncryptionHandlerImpl::ApplyNigoriUpdateImpl(
                << "due to full encryption.";
       passphrase_type_ = FROZEN_IMPLICIT_PASSPHRASE;
       FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                        OnPassphraseTypeChanged(passphrase_type_));
+                            OnPassphraseTypeChanged(
+                                passphrase_type_,
+                                GetExplicitPassphraseTime()));
     }
   } else {
     // It's possible that while we're waiting for migration a client that does
@@ -722,7 +738,9 @@ bool SyncEncryptionHandlerImpl::ApplyNigoriUpdateImpl(
         passphrase_type_ != CUSTOM_PASSPHRASE) {
       passphrase_type_ = CUSTOM_PASSPHRASE;
       FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                        OnPassphraseTypeChanged(passphrase_type_));
+                            OnPassphraseTypeChanged(
+                                passphrase_type_,
+                                GetExplicitPassphraseTime()));
     }
   }
 
@@ -859,6 +877,10 @@ void SyncEncryptionHandlerImpl::WriteEncryptionStateToNigori(
         UnlockVault(trans->GetWrappedTrans()).encrypted_types,
         encrypt_everything_,
         &nigori);
+    if (!custom_passphrase_time_.is_null()) {
+      nigori.set_custom_passphrase_time(
+          TimeToProtoTime(custom_passphrase_time_));
+    }
 
     // If nothing has changed, this is a no-op.
     nigori_node.SetNigoriSpecifics(nigori);
@@ -936,8 +958,11 @@ void SyncEncryptionHandlerImpl::SetCustomPassphrase(
     DVLOG(1) << "Setting custom passphrase.";
     cryptographer->GetBootstrapToken(&bootstrap_token);
     passphrase_type_ = CUSTOM_PASSPHRASE;
+    custom_passphrase_time_ = base::Time::Now();
     FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                      OnPassphraseTypeChanged(passphrase_type_));
+                            OnPassphraseTypeChanged(
+                                passphrase_type_,
+                                GetExplicitPassphraseTime()));
   } else {
     NOTREACHED() << "Failed to add key to cryptographer.";
     return;
@@ -1044,6 +1069,11 @@ void SyncEncryptionHandlerImpl::FinishSetPassphrase(
       nigori.set_keybag_is_frozen(
           IsExplicitPassphrase(passphrase_type_));
     }
+    // If we set a new custom passphrase, store the timestamp.
+    if (!custom_passphrase_time_.is_null()) {
+      nigori.set_custom_passphrase_time(
+          TimeToProtoTime(custom_passphrase_time_));
+    }
     nigori_node->SetNigoriSpecifics(nigori);
   }
 
@@ -1194,6 +1224,11 @@ bool SyncEncryptionHandlerImpl::AttemptToMigrateNigoriToKeystore(
     migration_time_ = base::Time::Now();
   migrated_nigori.set_keystore_migration_time(TimeToProtoTime(migration_time_));
 
+  if (!custom_passphrase_time_.is_null()) {
+    migrated_nigori.set_custom_passphrase_time(
+        TimeToProtoTime(custom_passphrase_time_));
+  }
+
   DVLOG(1) << "Completing nigori migration to keystore support.";
   nigori_node->SetNigoriSpecifics(migrated_nigori);
 
@@ -1204,7 +1239,9 @@ bool SyncEncryptionHandlerImpl::AttemptToMigrateNigoriToKeystore(
   if (passphrase_type_ != new_passphrase_type) {
     passphrase_type_ = new_passphrase_type;
     FOR_EACH_OBSERVER(SyncEncryptionHandler::Observer, observers_,
-                      OnPassphraseTypeChanged(passphrase_type_));
+                            OnPassphraseTypeChanged(
+                                passphrase_type_,
+                                GetExplicitPassphraseTime()));
   }
 
   if (new_encrypt_everything && !encrypt_everything_) {
@@ -1309,4 +1346,12 @@ bool SyncEncryptionHandlerImpl::DecryptPendingKeysWithKeystoreKey(
   return false;
 }
 
+base::Time SyncEncryptionHandlerImpl::GetExplicitPassphraseTime() const {
+  if (passphrase_type_ == FROZEN_IMPLICIT_PASSPHRASE)
+    return migration_time();
+  else if (passphrase_type_ == CUSTOM_PASSPHRASE)
+    return custom_passphrase_time();
+  return base::Time();
+}
+
 }  // namespace browser_sync
diff --git a/sync/internal_api/sync_encryption_handler_impl.h b/sync/internal_api/sync_encryption_handler_impl.h
index 27f7080..d93db15 100644
--- a/sync/internal_api/sync_encryption_handler_impl.h
+++ b/sync/internal_api/sync_encryption_handler_impl.h
@@ -87,6 +87,7 @@ class SyncEncryptionHandlerImpl
 
   bool MigratedToKeystore();
   base::Time migration_time() const;
+  base::Time custom_passphrase_time() const;
 
  private:
   FRIEND_TEST_ALL_PREFIXES(SyncEncryptionHandlerImplTest,
@@ -256,6 +257,10 @@ class SyncEncryptionHandlerImpl
   // Will not perform re-encryption.
   void EnableEncryptEverythingImpl(syncable::BaseTransaction* const trans);
 
+  // If an explicit passphrase is in use, returns the time at which it was set
+  // (if known). Else return base::Time().
+  base::Time GetExplicitPassphraseTime() const;
+
   base::ThreadChecker thread_checker_;
 
   base::WeakPtrFactory<SyncEncryptionHandlerImpl> weak_ptr_factory_;
@@ -289,6 +294,11 @@ class SyncEncryptionHandlerImpl
   // The time the nigori was migrated to support keystore encryption.
   base::Time migration_time_;
 
+  // The time the custom passphrase was set for this account. Not valid
+  // if there is no custom passphrase or the custom passphrase was set
+  // before support for this field was added.
+  base::Time custom_passphrase_time_;
+
   DISALLOW_COPY_AND_ASSIGN(SyncEncryptionHandlerImpl);
 };
 
diff --git a/sync/internal_api/sync_encryption_handler_impl_unittest.cc b/sync/internal_api/sync_encryption_handler_impl_unittest.cc
index aa9b9de..d8379e0 100644
--- a/sync/internal_api/sync_encryption_handler_impl_unittest.cc
+++ b/sync/internal_api/sync_encryption_handler_impl_unittest.cc
@@ -55,7 +55,8 @@ class SyncEncryptionHandlerObserverMock
                void(ModelTypeSet, bool));  // NOLINT
   MOCK_METHOD0(OnEncryptionComplete, void());  // NOLINT
   MOCK_METHOD1(OnCryptographerStateChanged, void(Cryptographer*));  // NOLINT
-  MOCK_METHOD1(OnPassphraseTypeChanged, void(PassphraseType));  // NOLINT
+  MOCK_METHOD2(OnPassphraseTypeChanged, void(PassphraseType,
+                                             base::Time));  // NOLINT
 };
 
 }  // namespace
@@ -148,6 +149,11 @@ class SyncEncryptionHandlerImplTest : public ::testing::Test {
       if (passphrase_type == CUSTOM_PASSPHRASE) {
         EXPECT_EQ(sync_pb::NigoriSpecifics::CUSTOM_PASSPHRASE,
                   nigori.passphrase_type());
+        if (!encryption_handler()->custom_passphrase_time().is_null()) {
+          EXPECT_EQ(nigori.custom_passphrase_time(),
+                    TimeToProtoTime(
+                        encryption_handler()->custom_passphrase_time()));
+        }
       } else {
         EXPECT_EQ(sync_pb::NigoriSpecifics::FROZEN_IMPLICIT_PASSPHRASE,
                   nigori.passphrase_type());
@@ -529,7 +535,7 @@ TEST_F(SyncEncryptionHandlerImplTest, MigrateOnDecryptImplicitPass) {
   EXPECT_CALL(*observer(),
               OnPassphraseAccepted());
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnBootstrapTokenUpdated(_, PASSPHRASE_BOOTSTRAP_TOKEN));
   EXPECT_CALL(*observer(),
@@ -573,7 +579,7 @@ TEST_F(SyncEncryptionHandlerImplTest, MigrateOnDecryptCustomPass) {
     EXPECT_CALL(*observer(),
                 OnPassphraseRequired(_, _));
     EXPECT_CALL(*observer(),
-                OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+                OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
     encryption_handler()->ApplyNigoriUpdate(nigori, trans.GetWrappedTrans());
     nigori_node.SetNigoriSpecifics(nigori);
   }
@@ -626,7 +632,7 @@ TEST_F(SyncEncryptionHandlerImplTest, MigrateOnKeystoreKeyAvailableImplicit) {
                                          trans.GetWrappedTrans());
   }
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
   // The actual migration gets posted, so run all pending tasks.
   PumpLoop();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
@@ -670,7 +676,7 @@ TEST_F(SyncEncryptionHandlerImplTest,
                                          trans.GetWrappedTrans());
   }
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(FROZEN_IMPLICIT_PASSPHRASE));
+              OnPassphraseTypeChanged(FROZEN_IMPLICIT_PASSPHRASE, _));
   // The actual migration gets posted, so run all pending tasks.
   PumpLoop();
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
@@ -697,11 +703,12 @@ TEST_F(SyncEncryptionHandlerImplTest,
   EXPECT_CALL(*observer(),
               OnEncryptionComplete());
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnBootstrapTokenUpdated(_, PASSPHRASE_BOOTSTRAP_TOKEN));
   encryption_handler()->Init();
   encryption_handler()->SetEncryptionPassphrase(kCurKey, true);
+  EXPECT_FALSE(encryption_handler()->custom_passphrase_time().is_null());
   Mock::VerifyAndClearExpectations(observer());
 
   EXPECT_CALL(*observer(),
@@ -747,11 +754,12 @@ TEST_F(SyncEncryptionHandlerImplTest,
   EXPECT_CALL(*observer(),
               OnEncryptionComplete());
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnBootstrapTokenUpdated(_, PASSPHRASE_BOOTSTRAP_TOKEN));
   encryption_handler()->Init();
   encryption_handler()->SetEncryptionPassphrase(kCurKey, true);
+  EXPECT_FALSE(encryption_handler()->custom_passphrase_time().is_null());
   Mock::VerifyAndClearExpectations(observer());
 
   {
@@ -815,7 +823,7 @@ TEST_F(SyncEncryptionHandlerImplTest, ReceiveMigratedNigoriKeystorePass) {
     EXPECT_CALL(*observer(),
                 OnBootstrapTokenUpdated(_, KEYSTORE_BOOTSTRAP_TOKEN));
     EXPECT_CALL(*observer(),
-                OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+                OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
     EXPECT_CALL(*observer(),
                 OnCryptographerStateChanged(_)).Times(AnyNumber());
     encryption_handler()->SetKeystoreKey(kRawKeystoreKey,
@@ -869,7 +877,7 @@ TEST_F(SyncEncryptionHandlerImplTest, ReceiveMigratedNigoriFrozenImplicitPass) {
 
   {
     EXPECT_CALL(*observer(),
-                OnPassphraseTypeChanged(FROZEN_IMPLICIT_PASSPHRASE));
+                OnPassphraseTypeChanged(FROZEN_IMPLICIT_PASSPHRASE, _));
     EXPECT_CALL(*observer(),
                 OnPassphraseRequired(_, _));
     EXPECT_CALL(*observer(),
@@ -948,7 +956,7 @@ TEST_F(SyncEncryptionHandlerImplTest, ReceiveMigratedNigoriCustomPass) {
 
   {
     EXPECT_CALL(*observer(),
-                OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+                OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
     EXPECT_CALL(*observer(),
                 OnPassphraseRequired(_, _));
     EXPECT_CALL(*observer(),
@@ -1030,7 +1038,7 @@ TEST_F(SyncEncryptionHandlerImplTest, ReceiveUnmigratedNigoriAfterMigration) {
   }
 
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnCryptographerStateChanged(_)).Times(AnyNumber());
   EXPECT_CALL(*observer(),
@@ -1108,7 +1116,7 @@ TEST_F(SyncEncryptionHandlerImplTest, ReceiveOldMigratedNigori) {
   }
 
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnCryptographerStateChanged(_)).Times(AnyNumber());
   EXPECT_CALL(*observer(),
@@ -1197,7 +1205,7 @@ TEST_F(SyncEncryptionHandlerImplTest, SetKeystoreAfterReceivingMigratedNigori) {
     nigori.set_passphrase_type(sync_pb::NigoriSpecifics::KEYSTORE_PASSPHRASE);
 
     EXPECT_CALL(*observer(),
-                OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+                OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
     EXPECT_CALL(*observer(),
                 OnCryptographerStateChanged(_)).Times(AnyNumber());
     EXPECT_CALL(*observer(),
@@ -1282,7 +1290,7 @@ TEST_F(SyncEncryptionHandlerImplTest, SetCustomPassAfterMigration) {
   }
 
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnCryptographerStateChanged(_)).Times(AnyNumber());
   EXPECT_CALL(*observer(),
@@ -1302,7 +1310,7 @@ TEST_F(SyncEncryptionHandlerImplTest, SetCustomPassAfterMigration) {
   EXPECT_CALL(*observer(),
               OnCryptographerStateChanged(_)).Times(AnyNumber());
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnBootstrapTokenUpdated(_, PASSPHRASE_BOOTSTRAP_TOKEN));
   EXPECT_CALL(*observer(),
@@ -1316,6 +1324,7 @@ TEST_F(SyncEncryptionHandlerImplTest, SetCustomPassAfterMigration) {
   EXPECT_TRUE(GetCryptographer()->is_ready());
   EXPECT_EQ(encryption_handler()->GetPassphraseType(), CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->EncryptEverythingEnabled());
+  EXPECT_FALSE(encryption_handler()->custom_passphrase_time().is_null());
   VerifyMigratedNigoriWithTimestamp(1, CUSTOM_PASSPHRASE, kNewKey);
 
   // Check that the cryptographer can decrypt the old key.
@@ -1379,7 +1388,7 @@ TEST_F(SyncEncryptionHandlerImplTest,
   EXPECT_CALL(*observer(),
               OnPassphraseRequired(_, _));
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnCryptographerStateChanged(_)).Times(AnyNumber());
   EXPECT_CALL(*observer(),
@@ -1408,7 +1417,7 @@ TEST_F(SyncEncryptionHandlerImplTest,
   EXPECT_CALL(*observer(),
               OnCryptographerStateChanged(_)).Times(AnyNumber());
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnBootstrapTokenUpdated(_, PASSPHRASE_BOOTSTRAP_TOKEN));
   EXPECT_CALL(*observer(),
@@ -1422,6 +1431,7 @@ TEST_F(SyncEncryptionHandlerImplTest,
   EXPECT_TRUE(GetCryptographer()->is_ready());
   EXPECT_EQ(encryption_handler()->GetPassphraseType(), CUSTOM_PASSPHRASE);
   EXPECT_TRUE(encryption_handler()->EncryptEverythingEnabled());
+  EXPECT_FALSE(encryption_handler()->custom_passphrase_time().is_null());
   VerifyMigratedNigoriWithTimestamp(1, CUSTOM_PASSPHRASE, kNewKey);
 
   // Check that the cryptographer can decrypt the old key.
@@ -1485,7 +1495,7 @@ TEST_F(SyncEncryptionHandlerImplTest,
   EXPECT_CALL(*observer(),
               OnPassphraseRequired(_, _));
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnCryptographerStateChanged(_)).Times(AnyNumber());
   EXPECT_CALL(*observer(),
@@ -1579,7 +1589,7 @@ TEST_F(SyncEncryptionHandlerImplTest,
   EXPECT_CALL(*observer(),
               OnPassphraseRequired(_, _));
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+              OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnCryptographerStateChanged(_)).Times(AnyNumber());
   EXPECT_CALL(*observer(),
@@ -1603,7 +1613,7 @@ TEST_F(SyncEncryptionHandlerImplTest,
   Mock::VerifyAndClearExpectations(observer());
 
   EXPECT_CALL(*observer(),
-              OnPassphraseTypeChanged(FROZEN_IMPLICIT_PASSPHRASE));
+              OnPassphraseTypeChanged(FROZEN_IMPLICIT_PASSPHRASE, _));
   EXPECT_CALL(*observer(),
               OnEncryptionComplete());
   EXPECT_CALL(*observer(),
@@ -1670,7 +1680,7 @@ TEST_F(SyncEncryptionHandlerImplTest,
                                          trans.GetWrappedTrans());
   }
   EXPECT_CALL(*observer(),
-            OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE));
+            OnPassphraseTypeChanged(KEYSTORE_PASSPHRASE, _));
   PumpLoop();
   Mock::VerifyAndClearExpectations(observer());
   EXPECT_TRUE(encryption_handler()->MigratedToKeystore());
diff --git a/sync/internal_api/sync_manager_impl.cc b/sync/internal_api/sync_manager_impl.cc
index b5ee26b..a11ff59 100644
--- a/sync/internal_api/sync_manager_impl.cc
+++ b/sync/internal_api/sync_manager_impl.cc
@@ -557,7 +557,9 @@ void SyncManagerImpl::OnCryptographerStateChanged(
       sync_encryption_handler_->migration_time());
 }
 
-void SyncManagerImpl::OnPassphraseTypeChanged(PassphraseType type) {
+void SyncManagerImpl::OnPassphraseTypeChanged(
+    PassphraseType type,
+    base::Time explicit_passphrase_time) {
   allstatus_.SetPassphraseType(type);
   allstatus_.SetKeystoreMigrationTime(
       sync_encryption_handler_->migration_time());
diff --git a/sync/internal_api/sync_manager_impl.h b/sync/internal_api/sync_manager_impl.h
index 2ead8f4..d96e64c 100644
--- a/sync/internal_api/sync_manager_impl.h
+++ b/sync/internal_api/sync_manager_impl.h
@@ -127,7 +127,9 @@ class SyncManagerImpl : public SyncManager,
   virtual void OnEncryptionComplete() OVERRIDE;
   virtual void OnCryptographerStateChanged(
       Cryptographer* cryptographer) OVERRIDE;
-  virtual void OnPassphraseTypeChanged(PassphraseType type) OVERRIDE;
+  virtual void OnPassphraseTypeChanged(
+      PassphraseType type,
+      base::Time explicit_passphrase_time) OVERRIDE;
 
   // Return the currently active (validated) username for use with syncable
   // types.
diff --git a/sync/internal_api/sync_manager_impl_unittest.cc b/sync/internal_api/sync_manager_impl_unittest.cc
index 362e305..64e3b31 100644
--- a/sync/internal_api/sync_manager_impl_unittest.cc
+++ b/sync/internal_api/sync_manager_impl_unittest.cc
@@ -697,7 +697,8 @@ class SyncEncryptionHandlerObserverMock
                void(ModelTypeSet, bool));  // NOLINT
   MOCK_METHOD0(OnEncryptionComplete, void());  // NOLINT
   MOCK_METHOD1(OnCryptographerStateChanged, void(Cryptographer*));  // NOLINT
-  MOCK_METHOD1(OnPassphraseTypeChanged, void(PassphraseType));  // NOLINT
+  MOCK_METHOD2(OnPassphraseTypeChanged, void(PassphraseType,
+                                             base::Time));  // NOLINT
 };
 
 }  // namespace
@@ -1501,7 +1502,7 @@ TEST_F(SyncManagerTest, EncryptDataTypesWithData) {
   EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
   EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
   EXPECT_CALL(encryption_observer_,
-              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
       "new_passphrase", true);
   EXPECT_TRUE(EncryptEverythingEnabledForTest());
@@ -1625,7 +1626,7 @@ TEST_F(SyncManagerTest, SetPassphraseWithPassword) {
   EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
   EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
   EXPECT_CALL(encryption_observer_,
-      OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+      OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
       "new_passphrase",
       true);
@@ -1811,7 +1812,7 @@ TEST_F(SyncManagerTest, SupplyPendingExplicitPass) {
   }
   EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
   EXPECT_CALL(encryption_observer_,
-              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+              OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   EXPECT_CALL(encryption_observer_, OnPassphraseRequired(_, _));
   EXPECT_CALL(encryption_observer_, OnEncryptedTypesChanged(_, false));
   sync_manager_.GetEncryptionHandler()->Init();
@@ -1896,7 +1897,7 @@ TEST_F(SyncManagerTest, SetPassphraseWithEmptyPasswordNode) {
   EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
   EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
   EXPECT_CALL(encryption_observer_,
-      OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+      OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
       "new_passphrase",
       true);
@@ -2123,7 +2124,7 @@ TEST_F(SyncManagerTest, UpdateEntryWithEncryption) {
   EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
   EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
   EXPECT_CALL(encryption_observer_,
-      OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+      OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
       "new_passphrase",
       true);
@@ -2322,7 +2323,7 @@ TEST_F(SyncManagerTest, UpdatePasswordNewPassphrase) {
   EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
   EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
   EXPECT_CALL(encryption_observer_,
-      OnPassphraseTypeChanged(CUSTOM_PASSPHRASE));
+      OnPassphraseTypeChanged(CUSTOM_PASSPHRASE, _));
   sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
       "new_passphrase",
       true);