diff --git a/MozillaFirefox.changes b/MozillaFirefox.changes
index cbf7845..cab8041 100644
--- a/MozillaFirefox.changes
+++ b/MozillaFirefox.changes
@@ -1,3 +1,8 @@
+-------------------------------------------------------------------
+Wed Dec 15 07:49:45 UTC 2010 - wr@rosenauer.org
+
+- update to version 4.0beta8
+
 -------------------------------------------------------------------
 Tue Nov 30 14:19:59 UTC 2010 - wr@rosenauer.org
 
diff --git a/MozillaFirefox.spec b/MozillaFirefox.spec
index 7297d93..2b68c13 100644
--- a/MozillaFirefox.spec
+++ b/MozillaFirefox.spec
@@ -22,7 +22,7 @@
 Name:           MozillaFirefox
 %define use_xulrunner 1
 %define xulrunner mozilla-xulrunner20
-BuildRequires:  Mesa-devel autoconf213 fdupes gcc-c++ libcurl-devel libgnomeui-devel libidl-devel libnotify-devel python unzip update-desktop-files yasm zip
+BuildRequires:  autoconf213 gcc-c++ libcurl-devel libgnomeui-devel libidl-devel libnotify-devel python unzip update-desktop-files zip fdupes Mesa-devel yasm
 %if %suse_version > 1110
 BuildRequires:  libiw-devel
 %else
@@ -33,10 +33,10 @@ BuildRequires:  %{xulrunner}-devel = 2.0b
 %endif
 License:        GPLv2+ ; LGPLv2.1+ ; MPLv1.1+
 Version:        4.0b
-Release:        1
 Provides:       web_browser
 Provides:       firefox = %{version}
-%define         releasedate 2010110500
+Release:        1
+%define         releasedate 2010121400
 Summary:        Mozilla Firefox Web Browser
 Url:            http://www.mozilla.org/
 Group:          Productivity/Networking/Web/Browsers
@@ -52,6 +52,7 @@ Source8:        firefox-mimeinfo.xml
 Source9:        firefox-lockdown.js
 Source10:       compare-locales.tar.bz2
 Source11:       firefox.1
+Patch0:         mozilla-firefox-sync.patch
 Patch1:         toolkit-download-folder.patch
 Patch2:         firefox-linkorder.patch
 Patch3:         firefox-browser-css.patch
@@ -99,7 +100,6 @@ plethora of extensions.
 
 
 %if %localize
-
 %package translations-common
 Summary:        Common translations for MozillaFirefox
 License:        GPLv2+ ; LGPLv2.1+ ; MPLv1.1+
@@ -152,6 +152,7 @@ This package provides upstream look and feel for MozillaFirefox.
 %prep
 %setup -q -n mozilla -b 7 -b 10
 cd $RPM_BUILD_DIR/mozilla
+%patch0 -p1
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
diff --git a/compare-locales.tar.bz2 b/compare-locales.tar.bz2
index 232b7d6..9ec2af4 100644
--- a/compare-locales.tar.bz2
+++ b/compare-locales.tar.bz2
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:261463e9d13184159c52595238b930fec66c86d3251a29610715d59b4ebe0a6e
-size 22830
+oid sha256:47a1baf950c41532733eb79e0d375a6e5b9936498ce88cc2fd0d8edaa92db465
+size 23407
diff --git a/firefox-4.0b-source.tar.bz2 b/firefox-4.0b-source.tar.bz2
index 78e61c8..d93dbdb 100644
--- a/firefox-4.0b-source.tar.bz2
+++ b/firefox-4.0b-source.tar.bz2
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:fd14bbe10cd0506d4e72d1ded9bd027b62daf8c7c8701729a903f117960e5444
-size 63321466
+oid sha256:4ab65679521bb96e45bb0f21916a3fa9cc41df4e44c4c85d7f3f833242d8ba64
+size 63741253
diff --git a/firefox-kde.patch b/firefox-kde.patch
index 464a3db..062969e 100644
--- a/firefox-kde.patch
+++ b/firefox-kde.patch
@@ -23,7 +23,7 @@ diff --git a/browser/base/content/browser-kde.xul b/browser/base/content/browser
 new file mode 100644
 --- /dev/null
 +++ b/browser/base/content/browser-kde.xul
-@@ -0,0 +1,965 @@
+@@ -0,0 +1,1042 @@
 +#filter substitution
 +<?xml version="1.0"?>
 +# -*- Mode: HTML -*-
@@ -62,6 +62,7 @@ new file mode 100644
 +#   Rob Campbell <rcampbell@mozilla.com>
 +#   Patrick Walton <pcwalton@mozilla.com>
 +#   David Dahl <ddahl@mozilla.com>
++#   Frank Yan <fyan@mozilla.com>
 +#
 +# Alternatively, the contents of this file may be used under the terms of
 +# either the GNU General Public License Version 2 or later (the "GPL"), or
@@ -79,6 +80,7 @@ new file mode 100644
 +
 +<?xml-stylesheet href="chrome://browser/content/browser.css" type="text/css"?>
 +<?xml-stylesheet href="chrome://browser/content/places/places.css" type="text/css"?>
++<?xml-stylesheet href="chrome://global/skin/webConsole.css" type="text/css"?>
 +<?xml-stylesheet href="chrome://browser/skin/" type="text/css"?>
 +
 +<?xul-overlay href="chrome://global/content/editMenuOverlay.xul"?>
@@ -114,7 +116,7 @@ new file mode 100644
 +        windowtype="navigator:browser"
 +        screenX="4" screenY="4"
 +        browsingmode="normal"
-+        persist="screenX screenY width height sizemode"> 
++        persist="screenX screenY width height sizemode">
 +
 +# All JS files which are not content (only) dependent that browser.xul
 +# wishes to include *must* go into the global-scripts.inc file
@@ -139,9 +141,6 @@ new file mode 100644
 +               onpopuphidden="if (event.target == this) TabContextMenu.contextTab = null;">
 +      <menuitem id="context_reloadTab" label="&reloadTab.label;" accesskey="&reloadTab.accesskey;"
 +                oncommand="gBrowser.reloadTab(TabContextMenu.contextTab);"/>
-+      <menuitem id="context_reloadAllTabs" label="&reloadAllTabs.label;" accesskey="&reloadAllTabs.accesskey;"
-+                tbattr="tabbrowser-multiple"
-+                oncommand="gBrowser.reloadAllTabs();"/>
 +      <menuseparator/>
 +      <menuitem id="context_pinTab" label="&pinAppTab.label;"
 +                accesskey="&pinAppTab.accesskey;"
@@ -154,7 +153,7 @@ new file mode 100644
 +        <menupopup id="context_tabViewMenuPopup"
 +                   onpopupshowing="if (event.target == this) TabView.updateContextMenu(TabContextMenu.contextTab, this);">
 +          <menuseparator id="context_tabViewNamedGroups" hidden="true"/>
-+          <menuitem label="&moveToNewGroup.label;"
++          <menuitem id="context_tabViewNewGroup" label="&moveToNewGroup.label;"
 +                    oncommand="TabView.moveTabTo(TabContextMenu.contextTab, null);"/>
 +        </menupopup>
 +      </menu>
@@ -163,13 +162,16 @@ new file mode 100644
 +                tbattr="tabbrowser-multiple"
 +                oncommand="gBrowser.replaceTabWithWindow(TabContextMenu.contextTab);"/>
 +      <menuseparator/>
++      <menuitem id="context_reloadAllTabs" label="&reloadAllTabs.label;" accesskey="&reloadAllTabs.accesskey;"
++                tbattr="tabbrowser-multiple"
++                oncommand="gBrowser.reloadAllTabs();"/>
 +      <menuitem id="context_bookmarkAllTabs"
 +                label="&bookmarkAllTabs.label;"
 +                accesskey="&bookmarkAllTabs.accesskey;"
 +                command="Browser:BookmarkAllTabs"/>
-+      <menuseparator/>
 +      <menuitem id="context_closeOtherTabs" label="&closeOtherTabs.label;" accesskey="&closeOtherTabs.accesskey;"
 +                oncommand="gBrowser.removeAllTabsBut(TabContextMenu.contextTab);"/>
++      <menuseparator/>
 +      <menuitem id="context_undoCloseTab"
 +                label="&undoCloseTab.label;"
 +                accesskey="&undoCloseTab.accesskey;"
@@ -193,11 +195,12 @@ new file mode 100644
 +    <panel type="autocomplete-richlistbox" id="PopupAutoCompleteRichResult" noautofocus="true" hidden="true"/>
 +
 +    <!-- for invalid form error message -->
-+    <panel id="invalid-form-popup" noautofocus="true" hidden="true" level="parent">
++    <panel id="invalid-form-popup" type="arrow" orient="vertical" noautofocus="true" hidden="true" level="parent">
 +      <description/>
 +    </panel>
 +
 +    <panel id="editBookmarkPanel"
++           type="arrow"
 +           orient="vertical"
 +           ignorekeys="true"
 +           hidden="true"
@@ -325,7 +328,7 @@ new file mode 100644
 +                accesskey="&viewCustomizeToolbar.accesskey;"/>
 +    </menupopup>
 +
-+    <menupopup id="blockedPopupOptions" 
++    <menupopup id="blockedPopupOptions"
 +               onpopupshowing="gPopupBlockerObserver.fillPopupList(event);">
 +      <menuitem observes="blockedPopupAllowSite"/>
 +      <menuitem observes="blockedPopupEditSettings"/>
@@ -357,10 +360,14 @@ new file mode 100644
 +
 +    <menupopup id="placesContext"/>
 +
-+    <panel id="notification-popup" type="arrow" position="after_start" noautofocus="true" hidden="true"/>
++    <panel id="notification-popup" type="arrow" position="after_start"
++           hidden="true" orient="vertical"/>
 +
 +    <!-- Popup for site identity information -->
-+    <panel id="identity-popup" position="after_start" hidden="true" noautofocus="true"
++    <panel id="identity-popup"
++           type="arrow"
++           hidden="true"
++           noautofocus="true"
 +           onpopupshown="document.getElementById('identity-popup-more-info-button').focus();"
 +           level="top">
 +      <hbox id="identity-popup-container" align="top">
@@ -455,29 +462,27 @@ new file mode 100644
 +    <tooltip id="tabbrowser-tab-tooltip" onpopupshowing="gBrowser.createTooltip(event);"/>
 +  </popupset>
 +
-+#ifdef MENUBAR_CAN_AUTOHIDE
-+  <vbox id="titlebar">
++#ifdef CAN_DRAW_IN_TITLEBAR
++<vbox id="titlebar">
 +  <hbox id="titlebar-content">
-+  <hbox id="appmenu-button-container" align="start">
-+  <button id="appmenu-button"
-+          type="menu"
-+#ifdef XP_WIN
-+          label="&brandShortName;"
-+#else
-+          label="&appMenuButton.label;"
-+#endif
-+          style="-moz-user-focus: ignore;">
++    <hbox id="appmenu-button-container">
++      <button id="appmenu-button"
++              type="menu"
++              label="&brandShortName;"
++              style="-moz-user-focus: ignore;">
 +#include browser-appmenu.inc
-+  </button>
++      </button>
++    </hbox>
++    <spacer id="titlebar-spacer" flex="1"/>
++    <hbox id="titlebar-buttonbox-container" align="start">
++      <hbox id="titlebar-buttonbox">
++        <toolbarbutton class="titlebar-button" id="titlebar-min" oncommand="window.minimize();"/>
++        <toolbarbutton class="titlebar-button" id="titlebar-max" oncommand="onTitlebarMaxClick();"/>
++        <toolbarbutton class="titlebar-button" id="titlebar-close" command="cmd_closeWindow"/>
++      </hbox>
++    </hbox>
 +  </hbox>
-+  <spacer id="titlebar-spacer" flex="1"/>
-+  <hbox id="titlebar-buttonbox">
-+    <toolbarbutton class="titlebar-button" id="titlebar-min" oncommand="window.minimize();"/>
-+    <toolbarbutton class="titlebar-button" id="titlebar-max" oncommand="onTitlebarMaxClick();"/>
-+    <toolbarbutton class="titlebar-button" id="titlebar-close" command="cmd_closeWindow"/>
-+  </hbox>
-+  </hbox>
-+  </vbox>
++</vbox>
 +#endif
 +
 +<deck flex="1" id="tab-view-deck">
@@ -501,7 +506,7 @@ new file mode 100644
 +#endif
 +             context="toolbar-context-menu">
 +      <toolbaritem id="menubar-items" align="center">
-+# The entire main menubar is placed into browser-menubar.inc, so that it can be shared by 
++# The entire main menubar is placed into browser-menubar.inc, so that it can be shared by
 +# hiddenWindow.xul.
 +#include browser-menubar.inc
 +      </toolbaritem>
@@ -512,10 +517,10 @@ new file mode 100644
 +             fullscreentoolbar="true" mode="icons" customizable="true"
 +#ifdef WINCE
 +             iconsize="small" defaulticonsize="small"
-+             defaultset="unified-back-forward-button,home-button,urlbar-container,reload-button,stop-button,search-container,bookmarks-menu-button-container,navigator-throbber,fullscreenflex,window-controls"
++             defaultset="unified-back-forward-button,urlbar-container,reload-button,stop-button,search-container,home-button,bookmarks-menu-button-container,navigator-throbber,fullscreenflex,window-controls"
 +#else
 +             iconsize="large"
-+             defaultset="unified-back-forward-button,home-button,urlbar-container,reload-button,stop-button,search-container,bookmarks-menu-button-container,fullscreenflex,window-controls"
++             defaultset="unified-back-forward-button,urlbar-container,reload-button,stop-button,search-container,home-button,bookmarks-menu-button-container,fullscreenflex,window-controls"
 +#endif
 +             context="toolbar-context-menu">
 +
@@ -534,16 +539,6 @@ new file mode 100644
 +                       tooltiptext="&forwardButton.tooltip;"/>
 +      </toolbaritem>
 +
-+      <toolbarbutton id="home-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
-+                     persist="class" removable="true"
-+                     label="&homeButton.label;"
-+                     ondragover="homeButtonObserver.onDragOver(event)"
-+                     ondragenter="homeButtonObserver.onDragOver(event)"
-+                     ondrop="homeButtonObserver.onDrop(event)"
-+                     ondragleave="homeButtonObserver.onDragLeave(event)"
-+                     onclick="BrowserGoHome(event);"
-+                     aboutHomeOverrideTooltip="&abouthome.pageTitle;"/>
-+
 +      <toolbaritem id="urlbar-container" align="center" flex="400" persist="width" combined="true"
 +                   title="&locationItem.title;" class="chromeclass-location" removable="true">
 +        <textbox id="urlbar" flex="1"
@@ -606,13 +601,16 @@ new file mode 100644
 +                   onclick="gURLBar.handleCommand(event);"/>
 +          </hbox>
 +          <toolbarbutton id="urlbar-go-button"
++                         class="chromeclass-toolbar-additional"
 +                         onclick="gURLBar.handleCommand(event);"
 +                         tooltiptext="&goEndCap.tooltip;"/>
 +          <toolbarbutton id="urlbar-reload-button"
++                         class="chromeclass-toolbar-additional"
 +                         command="Browser:ReloadOrDuplicate"
 +                         onclick="checkForMiddleClick(this, event);"
 +                         tooltiptext="&reloadButton.tooltip;"/>
 +          <toolbarbutton id="urlbar-stop-button"
++                         class="chromeclass-toolbar-additional"
 +                         command="Browser:Stop"
 +                         tooltiptext="&stopButton.tooltip;"/>
 +        </textbox>
@@ -635,6 +633,16 @@ new file mode 100644
 +        <searchbar id="searchbar" flex="1"/>
 +      </toolbaritem>
 +
++      <toolbarbutton id="home-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
++                     persist="class" removable="true"
++                     label="&homeButton.label;"
++                     ondragover="homeButtonObserver.onDragOver(event)"
++                     ondragenter="homeButtonObserver.onDragOver(event)"
++                     ondrop="homeButtonObserver.onDrop(event)"
++                     ondragexit="homeButtonObserver.onDragExit(event)"
++                     onclick="BrowserGoHome(event);"
++                     aboutHomeOverrideTooltip="&abouthome.pageTitle;"/>
++
 +      <toolbaritem id="bookmarks-menu-button-container"
 +                   class="chromeclass-toolbar-additional"
 +                   removable="true"
@@ -646,7 +654,7 @@ new file mode 100644
 +                       tooltiptext="&bookmarksMenuButton.tooltip;"
 +                       ondragenter="PlacesMenuDNDHandler.onDragEnter(event);"
 +                       ondragover="PlacesMenuDNDHandler.onDragOver(event);"
-+                       ondragleave="PlacesMenuDNDHandler.onDragLeave(event);"
++                       ondragexit="PlacesMenuDNDHandler.onDragExit(event);"
 +                       ondrop="PlacesMenuDNDHandler.onDrop(event);">
 +          <menupopup id="BMB_bookmarksPopup"
 +                     placespopup="true"
@@ -666,7 +674,7 @@ new file mode 100644
 +                      label="&viewBookmarksToolbar.label;"/>
 +            <menuseparator/>
 +            <menuitem id="BMB_bookmarksShowAll"
-+                      label="&showAllBookmarks.label;"
++                      label="&showAllBookmarks2.label;"
 +                      command="Browser:ShowAllBookmarks"
 +                      key="manBookmarkKb"/>
 +            <menuseparator/>
@@ -678,11 +686,17 @@ new file mode 100644
 +                      command="Browser:AddBookmarkAs"
 +                      key="addBookmarkAsKb"/>
 +            <menuitem id="BMB_subscribeToPageMenuitem"
++#ifndef XP_MACOSX
++                      class="menuitem-iconic"
++#endif
 +                      label="&subscribeToPageMenuitem.label;"
 +                      oncommand="return FeedHandler.subscribeToFeed(null, event);"
 +                      onclick="checkForMiddleClick(this, event);"
 +                      observes="singleFeedMenuitemState"/>
 +            <menu id="BMB_subscribeToPageMenupopup"
++#ifndef XP_MACOSX
++                  class="menu-iconic"
++#endif
 +                  label="&subscribeToPageMenupopup.label;"
 +                  observes="multipleFeedsMenuState">
 +              <menupopup id="BMB_subscribeToPageSubmenuMenupopup"
@@ -780,6 +794,13 @@ new file mode 100644
 +      </toolbaritem>
 +    </toolbar>
 +
++#ifdef MENUBAR_CAN_AUTOHIDE
++#ifndef CAN_DRAW_IN_TITLEBAR
++#define APPMENU_ON_TABBAR
++#endif
++#endif
++
++
 +    <toolbar id="TabsToolbar"
 +             fullscreentoolbar="true"
 +             customizable="true"
@@ -787,9 +808,23 @@ new file mode 100644
 +             iconsize="small" defaulticonsize="small" lockiconsize="true"
 +             aria-label="&tabsToolbar.label;"
 +             context="toolbar-context-menu"
++#ifdef APPMENU_ON_TABBAR
++             defaultset="appmenu-toolbar-button,tabbrowser-tabs,new-tab-button,alltabs-button,tabview-button,tabs-closebutton"
++#else
 +             defaultset="tabbrowser-tabs,new-tab-button,alltabs-button,tabview-button,tabs-closebutton"
++#endif
 +             collapsed="true">
 +
++#ifdef APPMENU_ON_TABBAR
++      <toolbarbutton id="appmenu-toolbar-button"
++                     class="chromeclass-toolbar-additional"
++                     type="menu"
++                     label="&brandShortName;"
++                     tooltiptext="&appMenuButton.tooltip;">
++#include browser-appmenu.inc
++      </toolbarbutton>
++#endif
++
 +      <tabs id="tabbrowser-tabs"
 +            class="tabbrowser-tabs"
 +            tabbrowser="content"
@@ -808,7 +843,7 @@ new file mode 100644
 +                     ondrop="newTabButtonObserver.onDrop(event)"
 +                     ondragover="newTabButtonObserver.onDragOver(event)"
 +                     ondragenter="newTabButtonObserver.onDragOver(event)"
-+                     ondragleave="newTabButtonObserver.onDragLeave(event)"
++                     ondragexit="newTabButtonObserver.onDragExit(event)"
 +                     removable="true"/>
 +
 +      <toolbarbutton id="alltabs-button"
@@ -855,7 +890,7 @@ new file mode 100644
 +                     ondrop="DownloadsButtonDNDObserver.onDrop(event)"
 +                     ondragover="DownloadsButtonDNDObserver.onDragOver(event)"
 +                     ondragenter="DownloadsButtonDNDObserver.onDragOver(event)"
-+                     ondragleave="DownloadsButtonDNDObserver.onDragLeave(event)"
++                     ondragexit="DownloadsButtonDNDObserver.onDragExit(event)"
 +                     label="&downloads.label;"
 +                     tooltiptext="&downloads.tooltip;"/>
 +
@@ -869,7 +904,7 @@ new file mode 100644
 +                     ondrop="bookmarksButtonObserver.onDrop(event)"
 +                     ondragover="bookmarksButtonObserver.onDragOver(event)"
 +                     ondragenter="bookmarksButtonObserver.onDragOver(event)"
-+                     ondragleave="bookmarksButtonObserver.onDragLeave(event)"/>
++                     ondragexit="bookmarksButtonObserver.onDragExit(event)"/>
 +
 +      <toolbarbutton id="new-window-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
 +                     label="&newNavigatorCmd.label;"
@@ -878,7 +913,7 @@ new file mode 100644
 +                     ondrop="newWindowButtonObserver.onDrop(event)"
 +                     ondragover="newWindowButtonObserver.onDragOver(event)"
 +                     ondragenter="newWindowButtonObserver.onDragOver(event)"
-+                     ondragleave="newWindowButtonObserver.onDragLeave(event)"/>
++                     ondragexit="newWindowButtonObserver.onDragExit(event)"/>
 +
 +      <toolbarbutton id="cut-button" class="toolbarbutton-1 chromeclass-toolbar-additional"
 +                     label="&cutCmd.label;"
@@ -935,6 +970,7 @@ new file mode 100644
 +  </toolbox>
 +
 +  <hbox flex="1" id="browser">
++    <vbox id="browser-border-start" hidden="true" layer="true"/>
 +    <vbox id="sidebar-box" hidden="true" class="chromeclass-extrachrome">
 +      <sidebarheader id="sidebar-header" align="center">
 +        <label id="sidebar-title" persist="value" flex="1" crop="end" control="sidebar"/>
@@ -954,6 +990,7 @@ new file mode 100644
 +                  autocompletepopup="PopupAutoComplete"
 +                  onclick="return contentAreaClick(event, false);"/>
 +    </vbox>
++    <vbox id="browser-border-end" hidden="true" layer="true"/>
 +  </hbox>
 +
 +  <vbox id="browser-bottombox" layer="true">
@@ -964,7 +1001,11 @@ new file mode 100644
 +             context="toolbar-context-menu" toolboxid="navigator-toolbox"
 +             mode="icons" iconsize="small" defaulticonsize="small"
 +             lockiconsize="true"
-+             customizable="true" align="right">
++             defaultset="addonbar-closebutton,spring,status-bar"
++             customizable="true">
++      <toolbarbutton id="addonbar-closebutton"
++                     tooltiptext="&addonBarCloseButton.tooltip;"
++                     oncommand="setToolbarVisibility(this.parentNode, false);"/>
 +      <statusbar id="status-bar"/>
 +    </toolbar>
 +  </vbox>
@@ -981,6 +1022,42 @@ new file mode 100644
 +    </svg:mask>
 +  </svg:svg>
 +#endif
++#ifdef XP_MACOSX
++  <svg:svg height="0">
++    <svg:mask id="pinstripe-tab-ontop-left-curve-mask" maskContentUnits="userSpaceOnUse">
++      <svg:circle cx="9" cy="3" r="3" fill="white"/>
++      <svg:rect x="9" y="0" width="3" height="3" fill="white"/>
++      <svg:rect x="6" y="3" width="6" height="19" fill="white"/>
++      <svg:rect x="1" y="17" width="5" height="5" fill="white"/>
++      <svg:circle cx="1" cy="17" r="5"/>
++      <svg:rect x="0" y="22" width="12" height="1" fill="white"/>
++    </svg:mask>
++    <svg:mask id="pinstripe-tab-ontop-right-curve-mask" maskContentUnits="userSpaceOnUse">
++      <svg:circle cx="3" cy="3" r="3" fill="white"/>
++      <svg:rect x="0" y="0" width="3" height="3" fill="white"/>
++      <svg:rect x="0" y="3" width="6" height="19" fill="white"/>
++      <svg:rect x="6" y="17" width="5" height="5" fill="white"/>
++      <svg:circle cx="11" cy="17" r="5"/>
++      <svg:rect x="0" y="22" width="12" height="1" fill="white"/>
++    </svg:mask>
++    <svg:mask id="pinstripe-tab-onbottom-left-curve-mask" maskContentUnits="userSpaceOnUse">
++      <svg:circle cx="9" cy="20" r="3" fill="white"/>
++      <svg:rect x="9" y="20" width="3" height="3" fill="white"/>
++      <svg:rect x="6" y="1" width="6" height="19" fill="white"/>
++      <svg:rect x="1" y="1" width="5" height="5" fill="white"/>
++      <svg:circle cx="1" cy="6" r="5"/>
++      <svg:rect x="0" y="0" width="12" height="1" fill="white"/>
++    </svg:mask>
++    <svg:mask id="pinstripe-tab-onbottom-right-curve-mask" maskContentUnits="userSpaceOnUse">
++      <svg:circle cx="3" cy="20" r="3" fill="white"/>
++      <svg:rect x="0" y="20" width="3" height="3" fill="white"/>
++      <svg:rect x="0" y="1" width="6" height="19" fill="white"/>
++      <svg:rect x="6" y="1" width="5" height="5" fill="white"/>
++      <svg:circle cx="11" cy="6" r="5"/>
++      <svg:rect x="0" y="0" width="12" height="1" fill="white"/>
++    </svg:mask>
++  </svg:svg>
++#endif
 +
 +</vbox>
 +# <iframe id="tab-view"> is dynamically appended as the 2nd child of #tab-view-deck.
@@ -1466,7 +1543,7 @@ new file mode 100644
 diff --git a/browser/installer/package-manifest.in b/browser/installer/package-manifest.in
 --- a/browser/installer/package-manifest.in
 +++ b/browser/installer/package-manifest.in
-@@ -432,16 +432,17 @@
+@@ -441,16 +441,17 @@
  #endif
  #endif
  
diff --git a/l10n-4.0b.tar.bz2 b/l10n-4.0b.tar.bz2
index dab0675..05d8cb4 100644
--- a/l10n-4.0b.tar.bz2
+++ b/l10n-4.0b.tar.bz2
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:350ee36ea52a8489990ec1592baef21edd1ce66521da0468f15adb01f2f2725d
-size 33149166
+oid sha256:8c47f90b7b1236f1bd7914a2a3028b89dc6f71b26658ff789b1ca421ad7dc6dc
+size 36318691
diff --git a/mozilla-firefox-sync.patch b/mozilla-firefox-sync.patch
new file mode 100644
index 0000000..ac019b5
--- /dev/null
+++ b/mozilla-firefox-sync.patch
@@ -0,0 +1,2068 @@
+diff -r b4e909a9ef0b browser/build.mk
+--- a/browser/build.mk	Wed Dec 15 08:45:58 2010 +0100
++++ b/browser/build.mk	Wed Dec 15 11:18:35 2010 +0100
+@@ -45,17 +45,17 @@ ifdef MOZ_EXTENSIONS
+ tier_app_dirs += extensions
+ endif
+ 
+ tier_app_dirs += $(MOZ_BRANDING_DIRECTORY)
+ 
+ tier_app_dirs += toolkit/components/console/hudservice
+ 
+ ifdef MOZ_SERVICES_SYNC
+-tier_app_dirs += services/sync
++tier_app_dirs += services
+ endif
+ 
+ tier_app_dirs += browser
+ # Never add other tier_app_dirs after browser. They won't get packaged
+ # properly on mac.
+ 
+ installer:
+ 	@$(MAKE) -C browser/installer installer
+diff -r b4e909a9ef0b browser/installer/package-manifest.in
+--- a/browser/installer/package-manifest.in	Wed Dec 15 08:45:58 2010 +0100
++++ b/browser/installer/package-manifest.in	Wed Dec 15 11:18:35 2010 +0100
+@@ -225,16 +225,17 @@
+ @BINPATH@/components/proxyObject.xpt
+ @BINPATH@/components/rdf.xpt
+ @BINPATH@/components/satchel.xpt
+ @BINPATH@/components/saxparser.xpt
+ @BINPATH@/components/sessionstore.xpt
+ #ifdef MOZ_SERVICES_SYNC
+ @BINPATH@/components/services-crypto.xpt
+ #endif
++@BINPATH@/components/services-crypto-component.xpt
+ @BINPATH@/components/shellservice.xpt
+ @BINPATH@/components/shistory.xpt
+ @BINPATH@/components/spellchecker.xpt
+ @BINPATH@/components/storage.xpt
+ @BINPATH@/components/toolkitprofile.xpt
+ #ifdef MOZ_ENABLE_XREMOTE
+ @BINPATH@/components/toolkitremote.xpt
+ #endif
+diff -r b4e909a9ef0b services/crypto/Makefile.in
+--- a/services/crypto/Makefile.in	Wed Dec 15 08:45:58 2010 +0100
++++ b/services/crypto/Makefile.in	Wed Dec 15 11:18:35 2010 +0100
+@@ -43,37 +43,18 @@ VPATH     = @srcdir@
+ 
+ include $(DEPTH)/config/autoconf.mk
+ 
+ MODULE = services-crypto
+ XPIDL_MODULE = services-crypto
+ 
+ XPIDLSRCS = \
+   IWeaveCrypto.idl \
+-  nsISyncJPAKE.idl \
+-  $(NULL)
+-
+-LIBRARY_NAME   = services-crypto
+-EXPORT_LIBRARY = 1
+-IS_COMPONENT   = 1
+-MODULE_NAME    = nsServicesCryptoModule
+-LIBXUL_LIBRARY = 1
+-FORCE_USE_PIC  = 1
+-MOZILLA_INTERNAL_API = 1
+-
+-CPPSRCS = \
+-  nsSyncJPAKE.cpp \
+   $(NULL)
+ 
+ libs::
+ 	$(PYTHON) $(topsrcdir)/config/nsinstall.py $(srcdir)/modules/* $(FINAL_TARGET)/modules/services-crypto
+ 
+ ifdef ENABLE_TESTS
+ DIRS += tests
+ endif
+ 
+ include $(topsrcdir)/config/rules.mk
+-
+-EXTRA_DSO_LDOPTS += \
+-	$(MOZ_COMPONENT_LIBS) \
+-    $(NSPR_LIBS) \
+-    $(NSS_LIBS) \
+-    $(NULL)
+diff -r b4e909a9ef0b services/crypto/component/Makefile.in
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ b/services/crypto/component/Makefile.in	Wed Dec 15 11:18:35 2010 +0100
+@@ -0,0 +1,75 @@
++#
++# ***** BEGIN LICENSE BLOCK *****
++# Version: MPL 1.1/GPL 2.0/LGPL 2.1
++#
++# The contents of this file are subject to the Mozilla Public License Version
++# 1.1 (the "License"); you may not use this file except in compliance with
++# the License. You may obtain a copy of the License at
++# http://www.mozilla.org/MPL/
++#
++# Software distributed under the License is distributed on an "AS IS" basis,
++# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
++# for the specific language governing rights and limitations under the
++# License.
++#
++# The Original Code is mozilla.org code.
++#
++# The Initial Developer of the Original Code is
++# the Mozilla Foundation.
++# Portions created by the Initial Developer are Copyright (C) 2010
++# the Initial Developer. All Rights Reserved.
++#
++# Contributor(s):
++# Philipp von Weitershausen <philipp@weitershausen.de>
++#
++# Alternatively, the contents of this file may be used under the terms of
++# either of the GNU General Public License Version 2 or later (the "GPL"),
++# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
++# in which case the provisions of the GPL or the LGPL are applicable instead
++# of those above. If you wish to allow use of your version of this file only
++# under the terms of either the GPL or the LGPL, and not to allow others to
++# use your version of this file under the terms of the MPL, indicate your
++# decision by deleting the provisions above and replace them with the notice
++# and other provisions required by the GPL or the LGPL. If you do not delete
++# the provisions above, a recipient may use your version of this file under
++# the terms of any one of the MPL, the GPL or the LGPL.
++#
++# ***** END LICENSE BLOCK *****
++
++DEPTH     = ../../..
++topsrcdir = @top_srcdir@
++srcdir    = @srcdir@
++VPATH     = @srcdir@
++
++include $(DEPTH)/config/autoconf.mk
++
++MODULE = services-crypto
++XPIDL_MODULE = services-crypto-component
++
++XPIDLSRCS = \
++  nsISyncJPAKE.idl \
++  $(NULL)
++
++LIBRARY_NAME   = services-crypto
++EXPORT_LIBRARY = 1
++IS_COMPONENT   = 1
++MODULE_NAME    = nsServicesCryptoModule
++LIBXUL_LIBRARY = 1
++FORCE_USE_PIC  = 1
++MOZILLA_INTERNAL_API = 1
++
++CPPSRCS = \
++  nsSyncJPAKE.cpp \
++  $(NULL)
++
++ifdef ENABLE_TESTS
++DIRS += tests
++endif
++
++include $(topsrcdir)/config/rules.mk
++
++EXTRA_DSO_LDOPTS += \
++    $(MOZ_COMPONENT_LIBS) \
++    $(NSPR_LIBS) \
++    $(NSS_LIBS) \
++    $(NULL)
+diff -r b4e909a9ef0b services/crypto/component/nsISyncJPAKE.idl
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ b/services/crypto/component/nsISyncJPAKE.idl	Wed Dec 15 11:18:35 2010 +0100
+@@ -0,0 +1,137 @@
++/* ***** BEGIN LICENSE BLOCK *****
++ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
++ *
++ * The contents of this file are subject to the Mozilla Public License Version
++ * 1.1 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ * http://www.mozilla.org/MPL/
++ *
++ * Software distributed under the License is distributed on an "AS IS" basis,
++ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
++ * for the specific language governing rights and limitations under the
++ * License.
++ *
++ * The Original Code is Firefox Sync.
++ *
++ * The Initial Developer of the Original Code is
++ * the Mozilla Foundation.
++ * Portions created by the Initial Developer are Copyright (C) 2010
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ * Brian Smith <bsmith@mozilla.com>
++ * Philipp von Weitershausen <philipp@weitershausen.de>
++ *
++ * Alternatively, the contents of this file may be used under the terms of
++ * either the GNU General Public License Version 2 or later (the "GPL"), or
++ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
++ * in which case the provisions of the GPL or the LGPL are applicable instead
++ * of those above. If you wish to allow use of your version of this file only
++ * under the terms of either the GPL or the LGPL, and not to allow others to
++ * use your version of this file under the terms of the MPL, indicate your
++ * decision by deleting the provisions above and replace them with the notice
++ * and other provisions required by the GPL or the LGPL. If you do not delete
++ * the provisions above, a recipient may use your version of this file under
++ * the terms of any one of the MPL, the GPL or the LGPL.
++ *
++ * ***** END LICENSE BLOCK ***** */
++
++#include "nsISupports.idl"
++
++[scriptable, uuid(5ab02a98-5122-4b90-93cd-f259c4b42e3a)]
++interface nsISyncJPAKE : nsISupports
++{
++  /**
++   * Perform first round of the JPAKE exchange.
++   *
++   * @param aSignerID
++   *        String identifying the signer.
++   * @param aGX1
++   *        Schnorr signature value g^x1, in hex representation.
++   * @param aGV1
++   *        Schnorr signature value g^v1 (v1 is a random value), in hex
++   *        representation.
++   * @param aR1
++   *        Schnorr signature value r1 = v1 - x1 * h, in hex representation.
++   * @param aGX2
++   *        Schnorr signature value g^x2, in hex representation.
++   * @param aGV2
++   *        Schnorr signature value g^v2 (v2 is a random value), in hex
++   *        representation.
++   * @param aR2
++   *        Schnorr signature value r2 = v2 - x2 * h, in hex representation.
++   */
++  void round1(in ACString aSignerID,
++              out ACString aGX1,
++              out ACString aGV1,
++              out ACString aR1,
++              out ACString aGX2,
++              out ACString aGV2,
++              out ACString aR2);
++
++  /**
++   * Perform second round of the JPAKE exchange.
++   *
++   * @param aPeerID
++   *        String identifying the peer.
++   * @param aPIN
++   *        String containing the weak secret (PIN).
++   * @param aGX3
++   *        Schnorr signature value g^x3, in hex representation.
++   * @param aGV3
++   *        Schnorr signature value g^v3 (v3 is a random value), in hex
++   *        representation.
++   * @param aR3
++   *        Schnorr signature value r3 = v3 - x3 * h, in hex representation.
++   * @param aGX4
++   *        Schnorr signature value g^x4, in hex representation.
++   * @param aGV4
++   *        Schnorr signature value g^v4 (v4 is a random value), in hex
++   *        representation.
++   * @param aR4
++   *        Schnorr signature value r4 = v4 - x4 * h, in hex representation.
++   * @param aA
++   *        Schnorr signature value A, in hex representation.
++   * @param aGVA
++   *        Schnorr signature value g^va (va is a random value), in hex
++   *        representation.
++   * @param aRA
++   *        Schnorr signature value ra = va - xa * h, in hex representation.
++   */
++  void round2(in ACString aPeerID,
++              in ACString aPIN,
++              in ACString aGX3,
++              in ACString aGV3,
++              in ACString aR3,
++              in ACString aGX4,
++              in ACString aGV4,
++              in ACString aR4,
++              out ACString aA,
++              out ACString aGVA,
++              out ACString aRA);
++
++  /**
++   * Perform the final step of the JPAKE exchange. This will compute
++   * the key and expand the key to two keys, an AES256 encryption key
++   * and a 256 bit HMAC key. It returns a key confirmation value
++   * (SHA256d of the key) and the encryption and HMAC keys.
++   *
++   * @param aB
++   *        Schnorr signature value B, in hex representation.
++   * @param aGVB
++   *        Schnorr signature value g^vb (vb is a random value), in hex
++   *        representation.
++   * @param aRB
++   *        Schnorr signature value rb = vb - xb * h, in hex representation.
++   * @param aAES256Key
++   *        The AES 256 encryption key, in base64 representation.
++   * @param aHMAC256Key
++   *        The 256 bit HMAC key, in base64 representation.
++   */
++  void final(in ACString aB,
++             in ACString aGVB,
++             in ACString aRB,
++             in ACString aHkdfInfo,
++             out ACString aAES256Key,
++             out ACString aHMAC256Key);
++};
+diff -r b4e909a9ef0b services/crypto/component/nsSyncJPAKE.cpp
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ b/services/crypto/component/nsSyncJPAKE.cpp	Wed Dec 15 11:18:35 2010 +0100
+@@ -0,0 +1,476 @@
++/* ***** BEGIN LICENSE BLOCK *****
++ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
++ *
++ * The contents of this file are subject to the Mozilla Public License Version
++ * 1.1 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ * http://www.mozilla.org/MPL/
++ *
++ * Software distributed under the License is distributed on an "AS IS" basis,
++ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
++ * for the specific language governing rights and limitations under the
++ * License.
++ *
++ * The Original Code is Firefox Sync.
++ *
++ * The Initial Developer of the Original Code is
++ * the Mozilla Foundation.
++ * Portions created by the Initial Developer are Copyright (C) 2010
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ * Brian Smith <bsmith@mozilla.com>
++ * Philipp von Weitershausen <philipp@weitershausen.de>
++ *
++ * Alternatively, the contents of this file may be used under the terms of
++ * either the GNU General Public License Version 2 or later (the "GPL"), or
++ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
++ * in which case the provisions of the GPL or the LGPL are applicable instead
++ * of those above. If you wish to allow use of your version of this file only
++ * under the terms of either the GPL or the LGPL, and not to allow others to
++ * use your version of this file under the terms of the MPL, indicate your
++ * decision by deleting the provisions above and replace them with the notice
++ * and other provisions required by the GPL or the LGPL. If you do not delete
++ * the provisions above, a recipient may use your version of this file under
++ * the terms of any one of the MPL, the GPL or the LGPL.
++ *
++ * ***** END LICENSE BLOCK ***** */
++
++#include "nsSyncJPAKE.h"
++#include "mozilla/ModuleUtils.h"
++#include <pk11pub.h>
++#include <keyhi.h>
++#include <pkcs11.h>
++#include <nscore.h>
++#include <secmodt.h>
++#include <secport.h>
++#include <secerr.h>
++#include <nsDebug.h>
++#include <nsError.h>
++#include <base64.h>
++#include <nsString.h>
++
++static PRBool
++hex_from_2char(const unsigned char *c2, unsigned char *byteval)
++{
++  int i;
++  unsigned char offset;
++  *byteval = 0;
++  for (i=0; i<2; i++) {
++    if (c2[i] >= '0' && c2[i] <= '9') {
++      offset = c2[i] - '0';
++      *byteval |= offset << 4*(1-i);
++    } else if (c2[i] >= 'a' && c2[i] <= 'f') {
++      offset = c2[i] - 'a';
++      *byteval |= (offset + 10) << 4*(1-i);
++    } else if (c2[i] >= 'A' && c2[i] <= 'F') {
++      offset = c2[i] - 'A';
++      *byteval |= (offset + 10) << 4*(1-i);
++    } else {
++      return PR_FALSE;
++    }
++  }
++  return PR_TRUE;
++}
++
++static PRBool
++fromHex(const char * str, unsigned char * p, size_t sLen)
++{
++  size_t i;
++  if (sLen & 1)
++    return PR_FALSE;
++
++  for (i = 0; i < sLen / 2; ++i) {
++    if (!hex_from_2char((const unsigned char *) str + (2*i),
++                        (unsigned char *) p + i)) {
++      return PR_FALSE;
++    }
++  }
++  return PR_TRUE;
++}
++
++static nsresult
++fromHexString(const nsACString & str, unsigned char * p, size_t pMaxLen)
++{
++  char * strData = (char *) str.Data();
++  unsigned len = str.Length();
++  NS_ENSURE_ARG(len / 2 <= pMaxLen);
++  if (!fromHex(strData, p, len)) {
++    return NS_ERROR_INVALID_ARG;
++  }
++  return NS_OK;
++}
++
++static PRBool
++toHexString(const unsigned char * str, unsigned len, nsACString & out)
++{
++  static const char digits[] = "0123456789ABCDEF";
++  if (!out.SetCapacity(2 * len))
++    return NS_ERROR_OUT_OF_MEMORY;
++  out.SetLength(0);
++  for (unsigned i = 0; i < len; ++i) {
++    out.Append(digits[str[i] >> 4]);
++    out.Append(digits[str[i] & 0x0f]);
++  }
++  return PR_TRUE;
++}
++
++static nsresult
++mapErrno()
++{
++  int err = PORT_GetError();
++  switch (err) {
++    case SEC_ERROR_NO_MEMORY:   return NS_ERROR_OUT_OF_MEMORY;
++    default:                    return NS_ERROR_UNEXPECTED;
++  }
++}
++
++#define NUM_ELEM(x) (sizeof(x) / sizeof (x)[0])
++
++static const char p[] = 
++  "90066455B5CFC38F9CAA4A48B4281F292C260FEEF01FD61037E56258A7795A1C"
++  "7AD46076982CE6BB956936C6AB4DCFE05E6784586940CA544B9B2140E1EB523F"
++  "009D20A7E7880E4E5BFA690F1B9004A27811CD9904AF70420EEFD6EA11EF7DA1"
++  "29F58835FF56B89FAA637BC9AC2EFAAB903402229F491D8D3485261CD068699B"
++  "6BA58A1DDBBEF6DB51E8FE34E8A78E542D7BA351C21EA8D8F1D29F5D5D159394"
++  "87E27F4416B0CA632C59EFD1B1EB66511A5A0FBF615B766C5862D0BD8A3FE7A0"
++  "E0DA0FB2FE1FCB19E8F9996A8EA0FCCDE538175238FC8B0EE6F29AF7F642773E"
++  "BE8CD5402415A01451A840476B2FCEB0E388D30D4B376C37FE401C2A2C2F941D"
++  "AD179C540C1C8CE030D460C4D983BE9AB0B20F69144C1AE13F9383EA1C08504F"
++  "B0BF321503EFE43488310DD8DC77EC5B8349B8BFE97C2C560EA878DE87C11E3D"
++  "597F1FEA742D73EEC7F37BE43949EF1A0D15C3F3E3FC0A8335617055AC91328E"
++  "C22B50FC15B941D3D1624CD88BC25F3E941FDDC6200689581BFEC416B4B2CB73";
++static const char q[] =
++  "CFA0478A54717B08CE64805B76E5B14249A77A4838469DF7F7DC987EFCCFB11D";
++static const char g[] = 
++  "5E5CBA992E0A680D885EB903AEA78E4A45A469103D448EDE3B7ACCC54D521E37"
++  "F84A4BDD5B06B0970CC2D2BBB715F7B82846F9A0C393914C792E6A923E2117AB"
++  "805276A975AADB5261D91673EA9AAFFEECBFA6183DFCB5D3B7332AA19275AFA1"
++  "F8EC0B60FB6F66CC23AE4870791D5982AAD1AA9485FD8F4A60126FEB2CF05DB8"
++  "A7F0F09B3397F3937F2E90B9E5B9C9B6EFEF642BC48351C46FB171B9BFA9EF17"
++  "A961CE96C7E7A7CC3D3D03DFAD1078BA21DA425198F07D2481622BCE45969D9C"
++  "4D6063D72AB7A0F08B2F49A7CC6AF335E08C4720E31476B67299E231F8BD90B3"
++  "9AC3AE3BE0C6B6CACEF8289A2E2873D58E51E029CAFBD55E6841489AB66B5B4B"
++  "9BA6E2F784660896AFF387D92844CCB8B69475496DE19DA2E58259B090489AC8"
++  "E62363CDF82CFD8EF2A427ABCD65750B506F56DDE3B988567A88126B914D7828"
++  "E2B63A6D7ED0747EC59E0E0A23CE7D8A74C1D2C2A7AFB6A29799620F00E11C33"
++  "787F7DED3B30E1A22D09F1FBDA1ABBBFBF25CAE05A13F812E34563F99410E73B";
++
++NS_IMETHODIMP nsSyncJPAKE::Round1(const nsACString & aSignerID,
++                                  nsACString & aGX1 NS_OUTPARAM,
++                                  nsACString & aGV1 NS_OUTPARAM,
++                                  nsACString & aR1 NS_OUTPARAM,
++                                  nsACString & aGX2 NS_OUTPARAM,
++                                  nsACString & aGV2 NS_OUTPARAM,
++                                  nsACString & aR2 NS_OUTPARAM)
++{
++  NS_ENSURE_STATE(round == JPAKENotStarted);
++  NS_ENSURE_STATE(key == NULL);
++
++  static CK_MECHANISM_TYPE mechanisms[] = {
++    CKM_NSS_JPAKE_ROUND1_SHA256,
++    CKM_NSS_JPAKE_ROUND2_SHA256,
++    CKM_NSS_JPAKE_FINAL_SHA256
++  };
++
++  PK11SlotInfo * slot = PK11_GetBestSlotMultiple(mechanisms,
++                                                 NUM_ELEM(mechanisms), NULL);
++  NS_ENSURE_STATE(slot != NULL);
++    
++  CK_BYTE pBuf[(NUM_ELEM(p) - 1) / 2];
++  CK_BYTE qBuf[(NUM_ELEM(q) - 1) / 2];
++  CK_BYTE gBuf[(NUM_ELEM(g) - 1) / 2];
++    
++  CK_KEY_TYPE keyType = CKK_NSS_JPAKE_ROUND1;
++  NS_ENSURE_STATE(fromHex(p, pBuf, (NUM_ELEM(p) - 1)));
++  NS_ENSURE_STATE(fromHex(q, qBuf, (NUM_ELEM(q) - 1)));
++  NS_ENSURE_STATE(fromHex(g, gBuf, (NUM_ELEM(g) - 1)));
++  CK_ATTRIBUTE keyTemplate[] = {
++    { CKA_NSS_JPAKE_SIGNERID, (CK_BYTE *) aSignerID.Data(),
++                              aSignerID.Length() },
++    { CKA_KEY_TYPE, &keyType, sizeof keyType },
++    { CKA_PRIME,    pBuf,     sizeof pBuf },
++    { CKA_SUBPRIME, qBuf,     sizeof qBuf },
++    { CKA_BASE,     gBuf,     sizeof gBuf }
++  };
++
++  CK_BYTE gx1Buf[NUM_ELEM(p) / 2];
++  CK_BYTE gv1Buf[NUM_ELEM(p) / 2];
++  CK_BYTE r1Buf [NUM_ELEM(p) / 2];
++  CK_BYTE gx2Buf[NUM_ELEM(p) / 2];
++  CK_BYTE gv2Buf[NUM_ELEM(p) / 2];
++  CK_BYTE r2Buf [NUM_ELEM(p) / 2];
++  CK_NSS_JPAKERound1Params rp = {
++      { gx1Buf, sizeof gx1Buf, gv1Buf, sizeof gv1Buf, r1Buf, sizeof r1Buf },
++      { gx2Buf, sizeof gx2Buf, gv2Buf, sizeof gv2Buf, r2Buf, sizeof r2Buf }
++  };
++  SECItem paramsItem;
++  paramsItem.data = (unsigned char *) &rp;
++  paramsItem.len = sizeof rp;
++  key = PK11_KeyGenWithTemplate(slot, CKM_NSS_JPAKE_ROUND1_SHA256,
++                                CKM_NSS_JPAKE_ROUND1_SHA256,
++                                &paramsItem, keyTemplate,
++                                NUM_ELEM(keyTemplate), NULL);
++  nsresult rv = key != NULL
++              ? NS_OK
++              : mapErrno();
++  if (rv == NS_OK) {
++    NS_ENSURE_TRUE(toHexString(rp.gx1.pGX, rp.gx1.ulGXLen, aGX1) &&
++                   toHexString(rp.gx1.pGV, rp.gx1.ulGVLen, aGV1) &&
++                   toHexString(rp.gx1.pR,  rp.gx1.ulRLen,  aR1)  &&
++                   toHexString(rp.gx2.pGX, rp.gx2.ulGXLen, aGX2) &&
++                   toHexString(rp.gx2.pGV, rp.gx2.ulGVLen, aGV2) &&
++                   toHexString(rp.gx2.pR,  rp.gx2.ulRLen,  aR2),
++                   NS_ERROR_OUT_OF_MEMORY);
++    round = JPAKEBeforeRound2;
++  }
++  return rv;
++}
++
++NS_IMETHODIMP nsSyncJPAKE::Round2(const nsACString & aPeerID,
++                                  const nsACString & aPIN,
++                                  const nsACString & aGX3,
++                                  const nsACString & aGV3,
++                                  const nsACString & aR3,
++                                  const nsACString & aGX4,
++                                  const nsACString & aGV4,
++                                  const nsACString & aR4,
++                                  nsACString & aA NS_OUTPARAM,
++                                  nsACString & aGVA NS_OUTPARAM,
++                                  nsACString & aRA NS_OUTPARAM)
++{
++  NS_ENSURE_STATE(round == JPAKEBeforeRound2);
++  NS_ENSURE_STATE(key != NULL);
++  NS_ENSURE_ARG(!aPeerID.IsEmpty());
++
++  /* PIN cannot be equal to zero when converted to a bignum. NSS 3.12.9 J-PAKE
++     assumes that the caller has already done this check. Future versions of 
++     NSS J-PAKE will do this check internally. See Bug 609068 Comment 4 */
++  PRBool foundNonZero = PR_FALSE;
++  for (size_t i = 0; i < aPIN.Length(); ++i) {
++    if (aPIN[i] != 0) {
++      foundNonZero = PR_TRUE;
++      break;
++    }
++  }
++  NS_ENSURE_ARG(foundNonZero);
++
++  CK_BYTE gx3Buf[NUM_ELEM(p)/2], gv3Buf[NUM_ELEM(p)/2], r3Buf [NUM_ELEM(p)/2];
++  CK_BYTE gx4Buf[NUM_ELEM(p)/2], gv4Buf[NUM_ELEM(p)/2], r4Buf [NUM_ELEM(p)/2];
++  CK_BYTE gxABuf[NUM_ELEM(p)/2], gvABuf[NUM_ELEM(p)/2], rABuf [NUM_ELEM(p)/2];
++  nsresult         rv = fromHexString(aGX3, gx3Buf, sizeof gx3Buf);
++  if (rv == NS_OK) rv = fromHexString(aGV3, gv3Buf, sizeof gv3Buf);
++  if (rv == NS_OK) rv = fromHexString(aR3,  r3Buf,  sizeof r3Buf);
++  if (rv == NS_OK) rv = fromHexString(aGX4, gx4Buf, sizeof gx4Buf);
++  if (rv == NS_OK) rv = fromHexString(aGV4, gv4Buf, sizeof gv4Buf);
++  if (rv == NS_OK) rv = fromHexString(aR4,  r4Buf,  sizeof r4Buf);
++  if (rv != NS_OK)
++    return rv;
++
++  CK_NSS_JPAKERound2Params rp;
++  rp.pSharedKey = (CK_BYTE *) aPIN.Data();
++  rp.ulSharedKeyLen = aPIN.Length();
++  rp.gx3.pGX = gx3Buf; rp.gx3.ulGXLen = aGX3.Length() / 2;
++  rp.gx3.pGV = gv3Buf; rp.gx3.ulGVLen = aGV3.Length() / 2;
++  rp.gx3.pR  = r3Buf;  rp.gx3.ulRLen  = aR3 .Length() / 2;
++  rp.gx4.pGX = gx4Buf; rp.gx4.ulGXLen = aGX4.Length() / 2;
++  rp.gx4.pGV = gv4Buf; rp.gx4.ulGVLen = aGV4.Length() / 2;
++  rp.gx4.pR  = r4Buf;  rp.gx4.ulRLen  = aR4 .Length() / 2;
++  rp.A.pGX   = gxABuf; rp.A  .ulGXLen = sizeof gxABuf;
++  rp.A.pGV   = gvABuf; rp.A  .ulGVLen = sizeof gxABuf;
++  rp.A.pR    = rABuf;  rp.A  .ulRLen  = sizeof gxABuf;
++  SECItem paramsItem;
++  paramsItem.data = (unsigned char *) &rp;
++  paramsItem.len = sizeof rp;
++  CK_KEY_TYPE keyType = CKK_NSS_JPAKE_ROUND2;
++  CK_ATTRIBUTE keyTemplate[] = {
++    { CKA_NSS_JPAKE_PEERID, (CK_BYTE *) aPeerID.Data(), aPeerID.Length(), },
++    { CKA_KEY_TYPE, &keyType, sizeof keyType }
++  };
++  PK11SymKey * newKey = PK11_DeriveWithTemplate(key,
++                                                CKM_NSS_JPAKE_ROUND2_SHA256,
++                                                &paramsItem,
++                                                CKM_NSS_JPAKE_FINAL_SHA256,
++                                                CKA_DERIVE, 0,
++                                                keyTemplate,
++                                                NUM_ELEM(keyTemplate),
++                                                PR_FALSE);
++  if (newKey != NULL) {
++    if (toHexString(rp.A.pGX, rp.A.ulGXLen, aA) &&
++        toHexString(rp.A.pGV, rp.A.ulGVLen, aGVA) &&
++        toHexString(rp.A.pR, rp.A.ulRLen, aRA)) {
++      round = JPAKEAfterRound2;
++      PK11_FreeSymKey(key);
++      key = newKey;
++      return NS_OK;
++    } else {
++      PK11_FreeSymKey(newKey);
++      rv = NS_ERROR_OUT_OF_MEMORY;
++    }
++  } else
++    rv = mapErrno();
++
++  return rv;
++}
++
++static nsresult
++setBase64(const unsigned char * data, unsigned len, nsACString & out)
++{
++  nsresult rv = NS_OK;
++  const char * base64 = BTOA_DataToAscii(data, len);
++  
++  if (base64 != NULL) {
++    size_t len = PORT_Strlen(base64);
++    if (out.SetCapacity(len)) {
++      out.SetLength(0);
++      out.Append(base64, len);
++      PORT_Free((void*) base64);
++    } else {
++      rv = NS_ERROR_OUT_OF_MEMORY;
++    }
++  } else {
++    rv = NS_ERROR_OUT_OF_MEMORY;
++  }
++  return rv;
++}
++
++static nsresult
++base64KeyValue(PK11SymKey * key, nsACString & keyString)
++{
++  nsresult rv = NS_OK;
++  if (PK11_ExtractKeyValue(key) == SECSuccess) {
++    const SECItem * value = PK11_GetKeyData(key);
++    rv = value != NULL && value->data != NULL && value->len > 0
++       ? setBase64(value->data, value->len, keyString)
++       : NS_ERROR_UNEXPECTED;
++  } else {
++    rv = mapErrno();
++  }
++  return rv;
++}
++
++static nsresult
++extractBase64KeyValue(PK11SymKey * keyBlock, CK_ULONG bitPosition,
++                      CK_MECHANISM_TYPE destMech, int keySize,
++                      nsACString & keyString)
++{
++  SECItem paramsItem;
++  paramsItem.data = (CK_BYTE *) &bitPosition;
++  paramsItem.len = sizeof bitPosition;
++  PK11SymKey * key = PK11_Derive(keyBlock, CKM_EXTRACT_KEY_FROM_KEY,
++                                 &paramsItem, destMech,
++                                 CKA_SIGN, keySize);
++  if (key == NULL)
++    return mapErrno();
++  nsresult rv = base64KeyValue(key, keyString);
++  PK11_FreeSymKey(key);
++  return rv;
++}
++
++
++NS_IMETHODIMP nsSyncJPAKE::Final(const nsACString & aB,
++                                 const nsACString & aGVB,
++                                 const nsACString & aRB,
++                                 const nsACString & aHKDFInfo,
++                                 nsACString & aAES256Key NS_OUTPARAM,
++                                 nsACString & aHMAC256Key NS_OUTPARAM)
++{
++  static const unsigned AES256_KEY_SIZE = 256 / 8;
++  static const unsigned HMAC_SHA256_KEY_SIZE = 256 / 8;
++  CK_EXTRACT_PARAMS aesBitPosition = 0;
++  CK_EXTRACT_PARAMS hmacBitPosition = aesBitPosition + (AES256_KEY_SIZE * 8);
++
++  NS_ENSURE_STATE(round == JPAKEAfterRound2);
++  NS_ENSURE_STATE(key != NULL);
++
++  CK_BYTE gxBBuf[NUM_ELEM(p)/2], gvBBuf[NUM_ELEM(p)/2], rBBuf [NUM_ELEM(p)/2];
++  nsresult         rv = fromHexString(aB,   gxBBuf, sizeof gxBBuf);
++  if (rv == NS_OK) rv = fromHexString(aGVB, gvBBuf, sizeof gvBBuf);
++  if (rv == NS_OK) rv = fromHexString(aRB,  rBBuf,  sizeof rBBuf);
++  if (rv != NS_OK)
++    return rv;
++
++  CK_NSS_JPAKEFinalParams rp;
++  rp.B.pGX = gxBBuf; rp.B.ulGXLen = aB  .Length() / 2;
++  rp.B.pGV = gvBBuf; rp.B.ulGVLen = aGVB.Length() / 2;
++  rp.B.pR  = rBBuf;  rp.B.ulRLen  = aRB .Length() / 2;
++  SECItem paramsItem;
++  paramsItem.data = (unsigned char *) &rp;
++  paramsItem.len = sizeof rp;
++  PK11SymKey * keyMaterial = PK11_Derive(key, CKM_NSS_JPAKE_FINAL_SHA256,
++                                         &paramsItem, CKM_NSS_HKDF_SHA256,
++                                         CKA_DERIVE, 0);
++  PK11SymKey * keyBlock = NULL;
++
++  if (keyMaterial == NULL)
++    rv = mapErrno();
++
++  if (rv == NS_OK) {
++    CK_NSS_HKDFParams hkdfParams;
++    hkdfParams.bExtract = CK_TRUE;
++    hkdfParams.pSalt = NULL;
++    hkdfParams.ulSaltLen = 0;
++    hkdfParams.bExpand = CK_TRUE;
++    hkdfParams.pInfo = (CK_BYTE *) aHKDFInfo.Data();
++    hkdfParams.ulInfoLen = aHKDFInfo.Length();
++    paramsItem.data = (unsigned char *) &hkdfParams;
++    paramsItem.len = sizeof hkdfParams;
++    keyBlock = PK11_Derive(keyMaterial, CKM_NSS_HKDF_SHA256,
++                           &paramsItem, CKM_EXTRACT_KEY_FROM_KEY,
++                           CKA_DERIVE, AES256_KEY_SIZE + HMAC_SHA256_KEY_SIZE);
++    if (keyBlock == NULL)
++      rv = mapErrno();
++  }
++
++  if (rv == NS_OK) {
++    rv = extractBase64KeyValue(keyBlock, aesBitPosition, CKM_AES_CBC,
++                               AES256_KEY_SIZE, aAES256Key);
++  }
++  if (rv == NS_OK) {
++    rv = extractBase64KeyValue(keyBlock, hmacBitPosition, CKM_SHA256_HMAC,
++                               HMAC_SHA256_KEY_SIZE, aHMAC256Key);
++  }
++
++  if (rv == NS_OK) {
++    SECStatus srv = PK11_ExtractKeyValue(keyMaterial);
++    NS_ENSURE_TRUE(srv == SECSuccess, NS_ERROR_UNEXPECTED); // XXX leaks
++    SECItem * keyMaterialBytes = PK11_GetKeyData(keyMaterial);
++    NS_ENSURE_TRUE(keyMaterialBytes != NULL, NS_ERROR_UNEXPECTED);
++  }
++
++  if (keyBlock != NULL)
++    PK11_FreeSymKey(keyBlock);
++  if (keyMaterial != NULL)
++    PK11_FreeSymKey(keyMaterial);
++
++  return rv;
++}
++
++NS_GENERIC_FACTORY_CONSTRUCTOR(nsSyncJPAKE)
++NS_DEFINE_NAMED_CID(NS_SYNCJPAKE_CID);
++
++nsSyncJPAKE::nsSyncJPAKE() : round(JPAKENotStarted), key(NULL) { }
++
++nsSyncJPAKE::~nsSyncJPAKE()
++{
++  if (key != NULL)
++    PK11_FreeSymKey(key);
++}
++
++static const mozilla::Module::CIDEntry kServicesCryptoCIDs[] = {
++  { &kNS_SYNCJPAKE_CID, false, NULL, nsSyncJPAKEConstructor },
++  { NULL }
++};
++
++static const mozilla::Module::ContractIDEntry kServicesCryptoContracts[] = {
++  { NS_SYNCJPAKE_CONTRACTID, &kNS_SYNCJPAKE_CID },
++  { NULL }
++};
++
++static const mozilla::Module kServicesCryptoModule = {
++  mozilla::Module::kVersion,
++  kServicesCryptoCIDs,
++  kServicesCryptoContracts
++};
++
++NSMODULE_DEFN(nsServicesCryptoModule) = &kServicesCryptoModule;
+diff -r b4e909a9ef0b services/crypto/component/nsSyncJPAKE.h
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ b/services/crypto/component/nsSyncJPAKE.h	Wed Dec 15 11:18:35 2010 +0100
+@@ -0,0 +1,65 @@
++/* ***** BEGIN LICENSE BLOCK *****
++ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
++ *
++ * The contents of this file are subject to the Mozilla Public License Version
++ * 1.1 (the "License"); you may not use this file except in compliance with
++ * the License. You may obtain a copy of the License at
++ * http://www.mozilla.org/MPL/
++ *
++ * Software distributed under the License is distributed on an "AS IS" basis,
++ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
++ * for the specific language governing rights and limitations under the
++ * License.
++ *
++ * The Original Code is Firefox Sync.
++ *
++ * The Initial Developer of the Original Code is
++ * the Mozilla Foundation.
++ * Portions created by the Initial Developer are Copyright (C) 2010
++ * the Initial Developer. All Rights Reserved.
++ *
++ * Contributor(s):
++ * Brian Smith <bsmith@mozilla.com>
++ * Philipp von Weitershausen <philipp@weitershausen.de>
++ *
++ * Alternatively, the contents of this file may be used under the terms of
++ * either the GNU General Public License Version 2 or later (the "GPL"), or
++ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
++ * in which case the provisions of the GPL or the LGPL are applicable instead
++ * of those above. If you wish to allow use of your version of this file only
++ * under the terms of either the GPL or the LGPL, and not to allow others to
++ * use your version of this file under the terms of the MPL, indicate your
++ * decision by deleting the provisions above and replace them with the notice
++ * and other provisions required by the GPL or the LGPL. If you do not delete
++ * the provisions above, a recipient may use your version of this file under
++ * the terms of any one of the MPL, the GPL or the LGPL.
++ *
++ * ***** END LICENSE BLOCK ***** */
++#ifndef nsSyncJPAKE_h__
++#define nsSyncJPAKE_h__
++
++#include "nsISyncJPAKE.h"
++
++#define NS_SYNCJPAKE_CONTRACTID \
++  "@mozilla.org/services-crypto/sync-jpake;1"
++
++#define NS_SYNCJPAKE_CID \
++  {0x0b9721c0, 0x1805, 0x47c3, {0x86, 0xce, 0x68, 0x13, 0x79, 0x5a, 0x78, 0x3f}}
++
++typedef struct PK11SymKeyStr PK11SymKey;
++
++class nsSyncJPAKE : public nsISyncJPAKE
++{
++public:
++  NS_DECL_ISUPPORTS
++  NS_DECL_NSISYNCJPAKE
++  nsSyncJPAKE();
++  virtual ~nsSyncJPAKE();
++private:
++  enum { JPAKENotStarted, JPAKEBeforeRound2, JPAKEAfterRound2 } round;
++  PK11SymKey * key;
++};
++
++NS_IMPL_ISUPPORTS1(nsSyncJPAKE, nsISyncJPAKE)
++
++#endif // nsSyncJPAKE_h__
+diff -r b4e909a9ef0b services/crypto/component/tests/Makefile.in
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ b/services/crypto/component/tests/Makefile.in	Wed Dec 15 11:18:35 2010 +0100
+@@ -0,0 +1,50 @@
++#
++# ***** BEGIN LICENSE BLOCK *****
++# Version: MPL 1.1/GPL 2.0/LGPL 2.1
++#
++# The contents of this file are subject to the Mozilla Public License Version
++# 1.1 (the "License"); you may not use this file except in compliance with
++# the License. You may obtain a copy of the License at
++# http://www.mozilla.org/MPL/
++#
++# Software distributed under the License is distributed on an "AS IS" basis,
++# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
++# for the specific language governing rights and limitations under the
++# License.
++#
++# The Original Code is mozilla.org code.
++#
++# The Initial Developer of the Original Code is
++# the Mozilla Foundation.
++# Portions created by the Initial Developer are Copyright (C) 2010
++# the Initial Developer. All Rights Reserved.
++#
++# Contributor(s):
++# Philipp von Weitershausen <philipp@weitershausen.de>
++#
++# Alternatively, the contents of this file may be used under the terms of
++# either of the GNU General Public License Version 2 or later (the "GPL"),
++# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
++# in which case the provisions of the GPL or the LGPL are applicable instead
++# of those above. If you wish to allow use of your version of this file only
++# under the terms of either the GPL or the LGPL, and not to allow others to
++# use your version of this file under the terms of the MPL, indicate your
++# decision by deleting the provisions above and replace them with the notice
++# and other provisions required by the GPL or the LGPL. If you do not delete
++# the provisions above, a recipient may use your version of this file under
++# the terms of any one of the MPL, the GPL or the LGPL.
++#
++# ***** END LICENSE BLOCK *****
++
++DEPTH     = ../../../..
++topsrcdir = @top_srcdir@
++srcdir    = @srcdir@
++VPATH     = @srcdir@
++relativesrcdir = services/crypto/components/tests
++
++include $(DEPTH)/config/autoconf.mk
++
++MODULE = test_services_crypto
++XPCSHELL_TESTS = unit
++
++include $(topsrcdir)/config/rules.mk
+diff -r b4e909a9ef0b services/crypto/component/tests/unit/test_jpake.js
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ b/services/crypto/component/tests/unit/test_jpake.js	Wed Dec 15 11:18:35 2010 +0100
+@@ -0,0 +1,197 @@
++const Cc = Components.classes;
++const Ci = Components.interfaces;
++
++// Ensure PSM is initialized.
++Cc["@mozilla.org/psm;1"].getService(Ci.nsISupports);
++
++function do_check_throws(func) {
++  let have_error = false;
++  try {
++    func();
++  } catch(ex) {
++    dump("Was expecting an exception. Caught: " + ex + "\n");
++    have_error = true;
++  }
++  do_check_true(have_error);
++}
++
++function test_success() {
++  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++
++  let a_gx1 = {};
++  let a_gv1 = {};
++  let a_r1 = {};
++  let a_gx2 = {};
++  let a_gv2 = {};
++  let a_r2 = {};
++
++  let b_gx1 = {};
++  let b_gv1 = {};
++  let b_r1 = {};
++  let b_gx2 = {};
++  let b_gv2 = {};
++  let b_r2 = {};
++
++  a.round1("alice", a_gx1, a_gv1, a_r1, a_gx2, a_gv2, a_r2);
++  b.round1("bob", b_gx1, b_gv1, b_r1, b_gx2, b_gv2, b_r2);
++
++  let a_A = {};
++  let a_gva = {};
++  let a_ra = {};
++
++  let b_A = {};
++  let b_gva = {};
++  let b_ra = {};
++
++  a.round2("bob", "sekrit", b_gx1.value, b_gv1.value, b_r1.value,
++           b_gx2.value, b_gv2.value, b_r2.value, a_A, a_gva, a_ra);
++  b.round2("alice", "sekrit", a_gx1.value, a_gv1.value, a_r1.value,
++           a_gx2.value, a_gv2.value, a_r2.value, b_A, b_gva, b_ra);
++
++  let a_aes = {};
++  let a_hmac = {};
++  let b_aes = {};
++  let b_hmac = {};
++
++  a.final(b_A.value, b_gva.value, b_ra.value, "ohai", a_aes, a_hmac);
++  b.final(a_A.value, a_gva.value, a_ra.value, "ohai", b_aes, b_hmac);
++
++  do_check_eq(a_aes.value, b_aes.value);
++  do_check_eq(a_hmac.value, b_hmac.value);
++}
++
++function test_failure(modlen) {
++  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++
++  let a_gx1 = {};
++  let a_gv1 = {};
++  let a_r1 = {};
++  let a_gx2 = {};
++  let a_gv2 = {};
++  let a_r2 = {};
++
++  let b_gx1 = {};
++  let b_gv1 = {};
++  let b_r1 = {};
++  let b_gx2 = {};
++  let b_gv2 = {};
++  let b_r2 = {};
++
++  a.round1("alice", a_gx1, a_gv1, a_r1, a_gx2, a_gv2, a_r2);
++  b.round1("bob", b_gx1, b_gv1, b_r1, b_gx2, b_gv2, b_r2);
++
++  let a_A = {};
++  let a_gva = {};
++  let a_ra = {};
++
++  let b_A = {};
++  let b_gva = {};
++  let b_ra = {};
++
++  // Note how the PINs are different (secret vs. sekrit)
++  a.round2("bob", "secret", b_gx1.value, b_gv1.value, b_r1.value,
++           b_gx2.value, b_gv2.value, b_r2.value, a_A, a_gva, a_ra);
++  b.round2("alice", "sekrit", a_gx1.value, a_gv1.value, a_r1.value,
++           a_gx2.value, a_gv2.value, a_r2.value, b_A, b_gva, b_ra);
++
++  let a_aes = {};
++  let a_hmac = {};
++  let b_aes = {};
++  let b_hmac = {};
++
++  a.final(b_A.value, b_gva.value, b_ra.value, "ohai", a_aes, a_hmac);
++  b.final(a_A.value, a_gva.value, a_ra.value, "ohai", b_aes, b_hmac);
++
++  do_check_neq(a_aes.value, b_aes.value);
++  do_check_neq(a_hmac.value, b_hmac.value);
++}
++
++function test_same_signerids() {
++  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++
++  let gx1 = {};
++  let gv1 = {};
++  let r1 = {};
++  let gx2 = {};
++  let gv2 = {};
++  let r2 = {};
++
++  a.round1("alice", {}, {}, {}, {}, {}, {});
++  b.round1("alice", gx1, gv1, r1, gx2, gv2, r2);
++  do_check_throws(function() {
++    a.round2("alice", "sekrit", gx1.value, gv1.value, r1.value,
++             gx2.value, gv2.value, r2.value, {}, {}, {});
++  });
++}
++
++function test_bad_zkp() {
++  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++
++  let gx1 = {};
++  let gv1 = {};
++  let r1 = {};
++  let gx2 = {};
++  let gv2 = {};
++  let r2 = {};
++
++  a.round1("alice", {}, {}, {}, {}, {}, {});
++  b.round1("bob", gx1, gv1, r1, gx2, gv2, r2);
++  do_check_throws(function() {
++    a.round2("invalid", "sekrit", gx1.value, gv1.value, r1.value,
++             gx2.value, gv2.value, r2.value, {}, {}, {});
++  });
++}
++
++function test_invalid_input_round2() {
++  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++
++  a.round1("alice", {}, {}, {}, {}, {}, {});
++  do_check_throws(function() {
++    a.round2("invalid", "sekrit", "some", "real", "garbage",
++             "even", "more", "garbage", {}, {}, {});
++  });
++}
++
++function test_invalid_input_final() {
++  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
++            .createInstance(Ci.nsISyncJPAKE);
++
++  let gx1 = {};
++  let gv1 = {};
++  let r1 = {};
++  let gx2 = {};
++  let gv2 = {};
++  let r2 = {};
++
++  a.round1("alice", {}, {}, {}, {}, {}, {});
++  b.round1("bob", gx1, gv1, r1, gx2, gv2, r2);
++  a.round2("bob", "sekrit", gx1.value, gv1.value, r1.value,
++           gx2.value, gv2.value, r2.value, {}, {}, {});
++  do_check_throws(function() {
++    a.final("some", "garbage", "alright", "foobar-info", {}, {});
++  });
++}
++
++function run_test() {
++  test_success();
++  test_failure();
++  test_same_signerids();
++  test_bad_zkp();
++  test_invalid_input_round2();
++  test_invalid_input_final();
++}
+diff -r b4e909a9ef0b services/crypto/nsISyncJPAKE.idl
+--- a/services/crypto/nsISyncJPAKE.idl	Wed Dec 15 08:45:58 2010 +0100
++++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
+@@ -1,137 +0,0 @@
+-/* ***** BEGIN LICENSE BLOCK *****
+- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+- *
+- * The contents of this file are subject to the Mozilla Public License Version
+- * 1.1 (the "License"); you may not use this file except in compliance with
+- * the License. You may obtain a copy of the License at
+- * http://www.mozilla.org/MPL/
+- *
+- * Software distributed under the License is distributed on an "AS IS" basis,
+- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+- * for the specific language governing rights and limitations under the
+- * License.
+- *
+- * The Original Code is Firefox Sync.
+- *
+- * The Initial Developer of the Original Code is
+- * the Mozilla Foundation.
+- * Portions created by the Initial Developer are Copyright (C) 2010
+- * the Initial Developer. All Rights Reserved.
+- *
+- * Contributor(s):
+- * Brian Smith <bsmith@mozilla.com>
+- * Philipp von Weitershausen <philipp@weitershausen.de>
+- *
+- * Alternatively, the contents of this file may be used under the terms of
+- * either the GNU General Public License Version 2 or later (the "GPL"), or
+- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+- * in which case the provisions of the GPL or the LGPL are applicable instead
+- * of those above. If you wish to allow use of your version of this file only
+- * under the terms of either the GPL or the LGPL, and not to allow others to
+- * use your version of this file under the terms of the MPL, indicate your
+- * decision by deleting the provisions above and replace them with the notice
+- * and other provisions required by the GPL or the LGPL. If you do not delete
+- * the provisions above, a recipient may use your version of this file under
+- * the terms of any one of the MPL, the GPL or the LGPL.
+- *
+- * ***** END LICENSE BLOCK ***** */
+-
+-#include "nsISupports.idl"
+-
+-[scriptable, uuid(5ab02a98-5122-4b90-93cd-f259c4b42e3a)]
+-interface nsISyncJPAKE : nsISupports
+-{
+-  /**
+-   * Perform first round of the JPAKE exchange.
+-   *
+-   * @param aSignerID
+-   *        String identifying the signer.
+-   * @param aGX1
+-   *        Schnorr signature value g^x1, in hex representation.
+-   * @param aGV1
+-   *        Schnorr signature value g^v1 (v1 is a random value), in hex
+-   *        representation.
+-   * @param aR1
+-   *        Schnorr signature value r1 = v1 - x1 * h, in hex representation.
+-   * @param aGX2
+-   *        Schnorr signature value g^x2, in hex representation.
+-   * @param aGV2
+-   *        Schnorr signature value g^v2 (v2 is a random value), in hex
+-   *        representation.
+-   * @param aR2
+-   *        Schnorr signature value r2 = v2 - x2 * h, in hex representation.
+-   */
+-  void round1(in ACString aSignerID,
+-              out ACString aGX1,
+-              out ACString aGV1,
+-              out ACString aR1,
+-              out ACString aGX2,
+-              out ACString aGV2,
+-              out ACString aR2);
+-
+-  /**
+-   * Perform second round of the JPAKE exchange.
+-   *
+-   * @param aPeerID
+-   *        String identifying the peer.
+-   * @param aPIN
+-   *        String containing the weak secret (PIN).
+-   * @param aGX3
+-   *        Schnorr signature value g^x3, in hex representation.
+-   * @param aGV3
+-   *        Schnorr signature value g^v3 (v3 is a random value), in hex
+-   *        representation.
+-   * @param aR3
+-   *        Schnorr signature value r3 = v3 - x3 * h, in hex representation.
+-   * @param aGX4
+-   *        Schnorr signature value g^x4, in hex representation.
+-   * @param aGV4
+-   *        Schnorr signature value g^v4 (v4 is a random value), in hex
+-   *        representation.
+-   * @param aR4
+-   *        Schnorr signature value r4 = v4 - x4 * h, in hex representation.
+-   * @param aA
+-   *        Schnorr signature value A, in hex representation.
+-   * @param aGVA
+-   *        Schnorr signature value g^va (va is a random value), in hex
+-   *        representation.
+-   * @param aRA
+-   *        Schnorr signature value ra = va - xa * h, in hex representation.
+-   */
+-  void round2(in ACString aPeerID,
+-              in ACString aPIN,
+-              in ACString aGX3,
+-              in ACString aGV3,
+-              in ACString aR3,
+-              in ACString aGX4,
+-              in ACString aGV4,
+-              in ACString aR4,
+-              out ACString aA,
+-              out ACString aGVA,
+-              out ACString aRA);
+-
+-  /**
+-   * Perform the final step of the JPAKE exchange. This will compute
+-   * the key and expand the key to two keys, an AES256 encryption key
+-   * and a 256 bit HMAC key. It returns a key confirmation value
+-   * (SHA256d of the key) and the encryption and HMAC keys.
+-   *
+-   * @param aB
+-   *        Schnorr signature value B, in hex representation.
+-   * @param aGVB
+-   *        Schnorr signature value g^vb (vb is a random value), in hex
+-   *        representation.
+-   * @param aRB
+-   *        Schnorr signature value rb = vb - xb * h, in hex representation.
+-   * @param aAES256Key
+-   *        The AES 256 encryption key, in base64 representation.
+-   * @param aHMAC256Key
+-   *        The 256 bit HMAC key, in base64 representation.
+-   */
+-  void final(in ACString aB,
+-             in ACString aGVB,
+-             in ACString aRB,
+-             in ACString aHkdfInfo,
+-             out ACString aAES256Key,
+-             out ACString aHMAC256Key);
+-};
+diff -r b4e909a9ef0b services/crypto/nsSyncJPAKE.cpp
+--- a/services/crypto/nsSyncJPAKE.cpp	Wed Dec 15 08:45:58 2010 +0100
++++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
+@@ -1,476 +0,0 @@
+-/* ***** BEGIN LICENSE BLOCK *****
+- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+- *
+- * The contents of this file are subject to the Mozilla Public License Version
+- * 1.1 (the "License"); you may not use this file except in compliance with
+- * the License. You may obtain a copy of the License at
+- * http://www.mozilla.org/MPL/
+- *
+- * Software distributed under the License is distributed on an "AS IS" basis,
+- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+- * for the specific language governing rights and limitations under the
+- * License.
+- *
+- * The Original Code is Firefox Sync.
+- *
+- * The Initial Developer of the Original Code is
+- * the Mozilla Foundation.
+- * Portions created by the Initial Developer are Copyright (C) 2010
+- * the Initial Developer. All Rights Reserved.
+- *
+- * Contributor(s):
+- * Brian Smith <bsmith@mozilla.com>
+- * Philipp von Weitershausen <philipp@weitershausen.de>
+- *
+- * Alternatively, the contents of this file may be used under the terms of
+- * either the GNU General Public License Version 2 or later (the "GPL"), or
+- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+- * in which case the provisions of the GPL or the LGPL are applicable instead
+- * of those above. If you wish to allow use of your version of this file only
+- * under the terms of either the GPL or the LGPL, and not to allow others to
+- * use your version of this file under the terms of the MPL, indicate your
+- * decision by deleting the provisions above and replace them with the notice
+- * and other provisions required by the GPL or the LGPL. If you do not delete
+- * the provisions above, a recipient may use your version of this file under
+- * the terms of any one of the MPL, the GPL or the LGPL.
+- *
+- * ***** END LICENSE BLOCK ***** */
+-
+-#include "nsSyncJPAKE.h"
+-#include "mozilla/ModuleUtils.h"
+-#include <pk11pub.h>
+-#include <keyhi.h>
+-#include <pkcs11.h>
+-#include <nscore.h>
+-#include <secmodt.h>
+-#include <secport.h>
+-#include <secerr.h>
+-#include <nsDebug.h>
+-#include <nsError.h>
+-#include <base64.h>
+-#include <nsString.h>
+-
+-static PRBool
+-hex_from_2char(const unsigned char *c2, unsigned char *byteval)
+-{
+-  int i;
+-  unsigned char offset;
+-  *byteval = 0;
+-  for (i=0; i<2; i++) {
+-    if (c2[i] >= '0' && c2[i] <= '9') {
+-      offset = c2[i] - '0';
+-      *byteval |= offset << 4*(1-i);
+-    } else if (c2[i] >= 'a' && c2[i] <= 'f') {
+-      offset = c2[i] - 'a';
+-      *byteval |= (offset + 10) << 4*(1-i);
+-    } else if (c2[i] >= 'A' && c2[i] <= 'F') {
+-      offset = c2[i] - 'A';
+-      *byteval |= (offset + 10) << 4*(1-i);
+-    } else {
+-      return PR_FALSE;
+-    }
+-  }
+-  return PR_TRUE;
+-}
+-
+-static PRBool
+-fromHex(const char * str, unsigned char * p, size_t sLen)
+-{
+-  size_t i;
+-  if (sLen & 1)
+-    return PR_FALSE;
+-
+-  for (i = 0; i < sLen / 2; ++i) {
+-    if (!hex_from_2char((const unsigned char *) str + (2*i),
+-                        (unsigned char *) p + i)) {
+-      return PR_FALSE;
+-    }
+-  }
+-  return PR_TRUE;
+-}
+-
+-static nsresult
+-fromHexString(const nsACString & str, unsigned char * p, size_t pMaxLen)
+-{
+-  char * strData = (char *) str.Data();
+-  unsigned len = str.Length();
+-  NS_ENSURE_ARG(len / 2 <= pMaxLen);
+-  if (!fromHex(strData, p, len)) {
+-    return NS_ERROR_INVALID_ARG;
+-  }
+-  return NS_OK;
+-}
+-
+-static PRBool
+-toHexString(const unsigned char * str, unsigned len, nsACString & out)
+-{
+-  static const char digits[] = "0123456789ABCDEF";
+-  if (!out.SetCapacity(2 * len))
+-    return NS_ERROR_OUT_OF_MEMORY;
+-  out.SetLength(0);
+-  for (unsigned i = 0; i < len; ++i) {
+-    out.Append(digits[str[i] >> 4]);
+-    out.Append(digits[str[i] & 0x0f]);
+-  }
+-  return PR_TRUE;
+-}
+-
+-static nsresult
+-mapErrno()
+-{
+-  int err = PORT_GetError();
+-  switch (err) {
+-    case SEC_ERROR_NO_MEMORY:   return NS_ERROR_OUT_OF_MEMORY;
+-    default:                    return NS_ERROR_UNEXPECTED;
+-  }
+-}
+-
+-#define NUM_ELEM(x) (sizeof(x) / sizeof (x)[0])
+-
+-static const char p[] = 
+-  "90066455B5CFC38F9CAA4A48B4281F292C260FEEF01FD61037E56258A7795A1C"
+-  "7AD46076982CE6BB956936C6AB4DCFE05E6784586940CA544B9B2140E1EB523F"
+-  "009D20A7E7880E4E5BFA690F1B9004A27811CD9904AF70420EEFD6EA11EF7DA1"
+-  "29F58835FF56B89FAA637BC9AC2EFAAB903402229F491D8D3485261CD068699B"
+-  "6BA58A1DDBBEF6DB51E8FE34E8A78E542D7BA351C21EA8D8F1D29F5D5D159394"
+-  "87E27F4416B0CA632C59EFD1B1EB66511A5A0FBF615B766C5862D0BD8A3FE7A0"
+-  "E0DA0FB2FE1FCB19E8F9996A8EA0FCCDE538175238FC8B0EE6F29AF7F642773E"
+-  "BE8CD5402415A01451A840476B2FCEB0E388D30D4B376C37FE401C2A2C2F941D"
+-  "AD179C540C1C8CE030D460C4D983BE9AB0B20F69144C1AE13F9383EA1C08504F"
+-  "B0BF321503EFE43488310DD8DC77EC5B8349B8BFE97C2C560EA878DE87C11E3D"
+-  "597F1FEA742D73EEC7F37BE43949EF1A0D15C3F3E3FC0A8335617055AC91328E"
+-  "C22B50FC15B941D3D1624CD88BC25F3E941FDDC6200689581BFEC416B4B2CB73";
+-static const char q[] =
+-  "CFA0478A54717B08CE64805B76E5B14249A77A4838469DF7F7DC987EFCCFB11D";
+-static const char g[] = 
+-  "5E5CBA992E0A680D885EB903AEA78E4A45A469103D448EDE3B7ACCC54D521E37"
+-  "F84A4BDD5B06B0970CC2D2BBB715F7B82846F9A0C393914C792E6A923E2117AB"
+-  "805276A975AADB5261D91673EA9AAFFEECBFA6183DFCB5D3B7332AA19275AFA1"
+-  "F8EC0B60FB6F66CC23AE4870791D5982AAD1AA9485FD8F4A60126FEB2CF05DB8"
+-  "A7F0F09B3397F3937F2E90B9E5B9C9B6EFEF642BC48351C46FB171B9BFA9EF17"
+-  "A961CE96C7E7A7CC3D3D03DFAD1078BA21DA425198F07D2481622BCE45969D9C"
+-  "4D6063D72AB7A0F08B2F49A7CC6AF335E08C4720E31476B67299E231F8BD90B3"
+-  "9AC3AE3BE0C6B6CACEF8289A2E2873D58E51E029CAFBD55E6841489AB66B5B4B"
+-  "9BA6E2F784660896AFF387D92844CCB8B69475496DE19DA2E58259B090489AC8"
+-  "E62363CDF82CFD8EF2A427ABCD65750B506F56DDE3B988567A88126B914D7828"
+-  "E2B63A6D7ED0747EC59E0E0A23CE7D8A74C1D2C2A7AFB6A29799620F00E11C33"
+-  "787F7DED3B30E1A22D09F1FBDA1ABBBFBF25CAE05A13F812E34563F99410E73B";
+-
+-NS_IMETHODIMP nsSyncJPAKE::Round1(const nsACString & aSignerID,
+-                                  nsACString & aGX1 NS_OUTPARAM,
+-                                  nsACString & aGV1 NS_OUTPARAM,
+-                                  nsACString & aR1 NS_OUTPARAM,
+-                                  nsACString & aGX2 NS_OUTPARAM,
+-                                  nsACString & aGV2 NS_OUTPARAM,
+-                                  nsACString & aR2 NS_OUTPARAM)
+-{
+-  NS_ENSURE_STATE(round == JPAKENotStarted);
+-  NS_ENSURE_STATE(key == NULL);
+-
+-  static CK_MECHANISM_TYPE mechanisms[] = {
+-    CKM_NSS_JPAKE_ROUND1_SHA256,
+-    CKM_NSS_JPAKE_ROUND2_SHA256,
+-    CKM_NSS_JPAKE_FINAL_SHA256
+-  };
+-
+-  PK11SlotInfo * slot = PK11_GetBestSlotMultiple(mechanisms,
+-                                                 NUM_ELEM(mechanisms), NULL);
+-  NS_ENSURE_STATE(slot != NULL);
+-    
+-  CK_BYTE pBuf[(NUM_ELEM(p) - 1) / 2];
+-  CK_BYTE qBuf[(NUM_ELEM(q) - 1) / 2];
+-  CK_BYTE gBuf[(NUM_ELEM(g) - 1) / 2];
+-    
+-  CK_KEY_TYPE keyType = CKK_NSS_JPAKE_ROUND1;
+-  NS_ENSURE_STATE(fromHex(p, pBuf, (NUM_ELEM(p) - 1)));
+-  NS_ENSURE_STATE(fromHex(q, qBuf, (NUM_ELEM(q) - 1)));
+-  NS_ENSURE_STATE(fromHex(g, gBuf, (NUM_ELEM(g) - 1)));
+-  CK_ATTRIBUTE keyTemplate[] = {
+-    { CKA_NSS_JPAKE_SIGNERID, (CK_BYTE *) aSignerID.Data(),
+-                              aSignerID.Length() },
+-    { CKA_KEY_TYPE, &keyType, sizeof keyType },
+-    { CKA_PRIME,    pBuf,     sizeof pBuf },
+-    { CKA_SUBPRIME, qBuf,     sizeof qBuf },
+-    { CKA_BASE,     gBuf,     sizeof gBuf }
+-  };
+-
+-  CK_BYTE gx1Buf[NUM_ELEM(p) / 2];
+-  CK_BYTE gv1Buf[NUM_ELEM(p) / 2];
+-  CK_BYTE r1Buf [NUM_ELEM(p) / 2];
+-  CK_BYTE gx2Buf[NUM_ELEM(p) / 2];
+-  CK_BYTE gv2Buf[NUM_ELEM(p) / 2];
+-  CK_BYTE r2Buf [NUM_ELEM(p) / 2];
+-  CK_NSS_JPAKERound1Params rp = {
+-      { gx1Buf, sizeof gx1Buf, gv1Buf, sizeof gv1Buf, r1Buf, sizeof r1Buf },
+-      { gx2Buf, sizeof gx2Buf, gv2Buf, sizeof gv2Buf, r2Buf, sizeof r2Buf }
+-  };
+-  SECItem paramsItem;
+-  paramsItem.data = (unsigned char *) &rp;
+-  paramsItem.len = sizeof rp;
+-  key = PK11_KeyGenWithTemplate(slot, CKM_NSS_JPAKE_ROUND1_SHA256,
+-                                CKM_NSS_JPAKE_ROUND1_SHA256,
+-                                &paramsItem, keyTemplate,
+-                                NUM_ELEM(keyTemplate), NULL);
+-  nsresult rv = key != NULL
+-              ? NS_OK
+-              : mapErrno();
+-  if (rv == NS_OK) {
+-    NS_ENSURE_TRUE(toHexString(rp.gx1.pGX, rp.gx1.ulGXLen, aGX1) &&
+-                   toHexString(rp.gx1.pGV, rp.gx1.ulGVLen, aGV1) &&
+-                   toHexString(rp.gx1.pR,  rp.gx1.ulRLen,  aR1)  &&
+-                   toHexString(rp.gx2.pGX, rp.gx2.ulGXLen, aGX2) &&
+-                   toHexString(rp.gx2.pGV, rp.gx2.ulGVLen, aGV2) &&
+-                   toHexString(rp.gx2.pR,  rp.gx2.ulRLen,  aR2),
+-                   NS_ERROR_OUT_OF_MEMORY);
+-    round = JPAKEBeforeRound2;
+-  }
+-  return rv;
+-}
+-
+-NS_IMETHODIMP nsSyncJPAKE::Round2(const nsACString & aPeerID,
+-                                  const nsACString & aPIN,
+-                                  const nsACString & aGX3,
+-                                  const nsACString & aGV3,
+-                                  const nsACString & aR3,
+-                                  const nsACString & aGX4,
+-                                  const nsACString & aGV4,
+-                                  const nsACString & aR4,
+-                                  nsACString & aA NS_OUTPARAM,
+-                                  nsACString & aGVA NS_OUTPARAM,
+-                                  nsACString & aRA NS_OUTPARAM)
+-{
+-  NS_ENSURE_STATE(round == JPAKEBeforeRound2);
+-  NS_ENSURE_STATE(key != NULL);
+-  NS_ENSURE_ARG(!aPeerID.IsEmpty());
+-
+-  /* PIN cannot be equal to zero when converted to a bignum. NSS 3.12.9 J-PAKE
+-     assumes that the caller has already done this check. Future versions of 
+-     NSS J-PAKE will do this check internally. See Bug 609068 Comment 4 */
+-  PRBool foundNonZero = PR_FALSE;
+-  for (size_t i = 0; i < aPIN.Length(); ++i) {
+-    if (aPIN[i] != 0) {
+-      foundNonZero = PR_TRUE;
+-      break;
+-    }
+-  }
+-  NS_ENSURE_ARG(foundNonZero);
+-
+-  CK_BYTE gx3Buf[NUM_ELEM(p)/2], gv3Buf[NUM_ELEM(p)/2], r3Buf [NUM_ELEM(p)/2];
+-  CK_BYTE gx4Buf[NUM_ELEM(p)/2], gv4Buf[NUM_ELEM(p)/2], r4Buf [NUM_ELEM(p)/2];
+-  CK_BYTE gxABuf[NUM_ELEM(p)/2], gvABuf[NUM_ELEM(p)/2], rABuf [NUM_ELEM(p)/2];
+-  nsresult         rv = fromHexString(aGX3, gx3Buf, sizeof gx3Buf);
+-  if (rv == NS_OK) rv = fromHexString(aGV3, gv3Buf, sizeof gv3Buf);
+-  if (rv == NS_OK) rv = fromHexString(aR3,  r3Buf,  sizeof r3Buf);
+-  if (rv == NS_OK) rv = fromHexString(aGX4, gx4Buf, sizeof gx4Buf);
+-  if (rv == NS_OK) rv = fromHexString(aGV4, gv4Buf, sizeof gv4Buf);
+-  if (rv == NS_OK) rv = fromHexString(aR4,  r4Buf,  sizeof r4Buf);
+-  if (rv != NS_OK)
+-    return rv;
+-
+-  CK_NSS_JPAKERound2Params rp;
+-  rp.pSharedKey = (CK_BYTE *) aPIN.Data();
+-  rp.ulSharedKeyLen = aPIN.Length();
+-  rp.gx3.pGX = gx3Buf; rp.gx3.ulGXLen = aGX3.Length() / 2;
+-  rp.gx3.pGV = gv3Buf; rp.gx3.ulGVLen = aGV3.Length() / 2;
+-  rp.gx3.pR  = r3Buf;  rp.gx3.ulRLen  = aR3 .Length() / 2;
+-  rp.gx4.pGX = gx4Buf; rp.gx4.ulGXLen = aGX4.Length() / 2;
+-  rp.gx4.pGV = gv4Buf; rp.gx4.ulGVLen = aGV4.Length() / 2;
+-  rp.gx4.pR  = r4Buf;  rp.gx4.ulRLen  = aR4 .Length() / 2;
+-  rp.A.pGX   = gxABuf; rp.A  .ulGXLen = sizeof gxABuf;
+-  rp.A.pGV   = gvABuf; rp.A  .ulGVLen = sizeof gxABuf;
+-  rp.A.pR    = rABuf;  rp.A  .ulRLen  = sizeof gxABuf;
+-  SECItem paramsItem;
+-  paramsItem.data = (unsigned char *) &rp;
+-  paramsItem.len = sizeof rp;
+-  CK_KEY_TYPE keyType = CKK_NSS_JPAKE_ROUND2;
+-  CK_ATTRIBUTE keyTemplate[] = {
+-    { CKA_NSS_JPAKE_PEERID, (CK_BYTE *) aPeerID.Data(), aPeerID.Length(), },
+-    { CKA_KEY_TYPE, &keyType, sizeof keyType }
+-  };
+-  PK11SymKey * newKey = PK11_DeriveWithTemplate(key,
+-                                                CKM_NSS_JPAKE_ROUND2_SHA256,
+-                                                &paramsItem,
+-                                                CKM_NSS_JPAKE_FINAL_SHA256,
+-                                                CKA_DERIVE, 0,
+-                                                keyTemplate,
+-                                                NUM_ELEM(keyTemplate),
+-                                                PR_FALSE);
+-  if (newKey != NULL) {
+-    if (toHexString(rp.A.pGX, rp.A.ulGXLen, aA) &&
+-        toHexString(rp.A.pGV, rp.A.ulGVLen, aGVA) &&
+-        toHexString(rp.A.pR, rp.A.ulRLen, aRA)) {
+-      round = JPAKEAfterRound2;
+-      PK11_FreeSymKey(key);
+-      key = newKey;
+-      return NS_OK;
+-    } else {
+-      PK11_FreeSymKey(newKey);
+-      rv = NS_ERROR_OUT_OF_MEMORY;
+-    }
+-  } else
+-    rv = mapErrno();
+-
+-  return rv;
+-}
+-
+-static nsresult
+-setBase64(const unsigned char * data, unsigned len, nsACString & out)
+-{
+-  nsresult rv = NS_OK;
+-  const char * base64 = BTOA_DataToAscii(data, len);
+-  
+-  if (base64 != NULL) {
+-    size_t len = PORT_Strlen(base64);
+-    if (out.SetCapacity(len)) {
+-      out.SetLength(0);
+-      out.Append(base64, len);
+-      PORT_Free((void*) base64);
+-    } else {
+-      rv = NS_ERROR_OUT_OF_MEMORY;
+-    }
+-  } else {
+-    rv = NS_ERROR_OUT_OF_MEMORY;
+-  }
+-  return rv;
+-}
+-
+-static nsresult
+-base64KeyValue(PK11SymKey * key, nsACString & keyString)
+-{
+-  nsresult rv = NS_OK;
+-  if (PK11_ExtractKeyValue(key) == SECSuccess) {
+-    const SECItem * value = PK11_GetKeyData(key);
+-    rv = value != NULL && value->data != NULL && value->len > 0
+-       ? setBase64(value->data, value->len, keyString)
+-       : NS_ERROR_UNEXPECTED;
+-  } else {
+-    rv = mapErrno();
+-  }
+-  return rv;
+-}
+-
+-static nsresult
+-extractBase64KeyValue(PK11SymKey * keyBlock, CK_ULONG bitPosition,
+-                      CK_MECHANISM_TYPE destMech, int keySize,
+-                      nsACString & keyString)
+-{
+-  SECItem paramsItem;
+-  paramsItem.data = (CK_BYTE *) &bitPosition;
+-  paramsItem.len = sizeof bitPosition;
+-  PK11SymKey * key = PK11_Derive(keyBlock, CKM_EXTRACT_KEY_FROM_KEY,
+-                                 &paramsItem, destMech,
+-                                 CKA_SIGN, keySize);
+-  if (key == NULL)
+-    return mapErrno();
+-  nsresult rv = base64KeyValue(key, keyString);
+-  PK11_FreeSymKey(key);
+-  return rv;
+-}
+-
+-
+-NS_IMETHODIMP nsSyncJPAKE::Final(const nsACString & aB,
+-                                 const nsACString & aGVB,
+-                                 const nsACString & aRB,
+-                                 const nsACString & aHKDFInfo,
+-                                 nsACString & aAES256Key NS_OUTPARAM,
+-                                 nsACString & aHMAC256Key NS_OUTPARAM)
+-{
+-  static const unsigned AES256_KEY_SIZE = 256 / 8;
+-  static const unsigned HMAC_SHA256_KEY_SIZE = 256 / 8;
+-  CK_EXTRACT_PARAMS aesBitPosition = 0;
+-  CK_EXTRACT_PARAMS hmacBitPosition = aesBitPosition + (AES256_KEY_SIZE * 8);
+-
+-  NS_ENSURE_STATE(round == JPAKEAfterRound2);
+-  NS_ENSURE_STATE(key != NULL);
+-
+-  CK_BYTE gxBBuf[NUM_ELEM(p)/2], gvBBuf[NUM_ELEM(p)/2], rBBuf [NUM_ELEM(p)/2];
+-  nsresult         rv = fromHexString(aB,   gxBBuf, sizeof gxBBuf);
+-  if (rv == NS_OK) rv = fromHexString(aGVB, gvBBuf, sizeof gvBBuf);
+-  if (rv == NS_OK) rv = fromHexString(aRB,  rBBuf,  sizeof rBBuf);
+-  if (rv != NS_OK)
+-    return rv;
+-
+-  CK_NSS_JPAKEFinalParams rp;
+-  rp.B.pGX = gxBBuf; rp.B.ulGXLen = aB  .Length() / 2;
+-  rp.B.pGV = gvBBuf; rp.B.ulGVLen = aGVB.Length() / 2;
+-  rp.B.pR  = rBBuf;  rp.B.ulRLen  = aRB .Length() / 2;
+-  SECItem paramsItem;
+-  paramsItem.data = (unsigned char *) &rp;
+-  paramsItem.len = sizeof rp;
+-  PK11SymKey * keyMaterial = PK11_Derive(key, CKM_NSS_JPAKE_FINAL_SHA256,
+-                                         &paramsItem, CKM_NSS_HKDF_SHA256,
+-                                         CKA_DERIVE, 0);
+-  PK11SymKey * keyBlock = NULL;
+-
+-  if (keyMaterial == NULL)
+-    rv = mapErrno();
+-
+-  if (rv == NS_OK) {
+-    CK_NSS_HKDFParams hkdfParams;
+-    hkdfParams.bExtract = CK_TRUE;
+-    hkdfParams.pSalt = NULL;
+-    hkdfParams.ulSaltLen = 0;
+-    hkdfParams.bExpand = CK_TRUE;
+-    hkdfParams.pInfo = (CK_BYTE *) aHKDFInfo.Data();
+-    hkdfParams.ulInfoLen = aHKDFInfo.Length();
+-    paramsItem.data = (unsigned char *) &hkdfParams;
+-    paramsItem.len = sizeof hkdfParams;
+-    keyBlock = PK11_Derive(keyMaterial, CKM_NSS_HKDF_SHA256,
+-                           &paramsItem, CKM_EXTRACT_KEY_FROM_KEY,
+-                           CKA_DERIVE, AES256_KEY_SIZE + HMAC_SHA256_KEY_SIZE);
+-    if (keyBlock == NULL)
+-      rv = mapErrno();
+-  }
+-
+-  if (rv == NS_OK) {
+-    rv = extractBase64KeyValue(keyBlock, aesBitPosition, CKM_AES_CBC,
+-                               AES256_KEY_SIZE, aAES256Key);
+-  }
+-  if (rv == NS_OK) {
+-    rv = extractBase64KeyValue(keyBlock, hmacBitPosition, CKM_SHA256_HMAC,
+-                               HMAC_SHA256_KEY_SIZE, aHMAC256Key);
+-  }
+-
+-  if (rv == NS_OK) {
+-    SECStatus srv = PK11_ExtractKeyValue(keyMaterial);
+-    NS_ENSURE_TRUE(srv == SECSuccess, NS_ERROR_UNEXPECTED); // XXX leaks
+-    SECItem * keyMaterialBytes = PK11_GetKeyData(keyMaterial);
+-    NS_ENSURE_TRUE(keyMaterialBytes != NULL, NS_ERROR_UNEXPECTED);
+-  }
+-
+-  if (keyBlock != NULL)
+-    PK11_FreeSymKey(keyBlock);
+-  if (keyMaterial != NULL)
+-    PK11_FreeSymKey(keyMaterial);
+-
+-  return rv;
+-}
+-
+-NS_GENERIC_FACTORY_CONSTRUCTOR(nsSyncJPAKE)
+-NS_DEFINE_NAMED_CID(NS_SYNCJPAKE_CID);
+-
+-nsSyncJPAKE::nsSyncJPAKE() : round(JPAKENotStarted), key(NULL) { }
+-
+-nsSyncJPAKE::~nsSyncJPAKE()
+-{
+-  if (key != NULL)
+-    PK11_FreeSymKey(key);
+-}
+-
+-static const mozilla::Module::CIDEntry kServicesCryptoCIDs[] = {
+-  { &kNS_SYNCJPAKE_CID, false, NULL, nsSyncJPAKEConstructor },
+-  { NULL }
+-};
+-
+-static const mozilla::Module::ContractIDEntry kServicesCryptoContracts[] = {
+-  { NS_SYNCJPAKE_CONTRACTID, &kNS_SYNCJPAKE_CID },
+-  { NULL }
+-};
+-
+-static const mozilla::Module kServicesCryptoModule = {
+-  mozilla::Module::kVersion,
+-  kServicesCryptoCIDs,
+-  kServicesCryptoContracts
+-};
+-
+-NSMODULE_DEFN(nsServicesCryptoModule) = &kServicesCryptoModule;
+diff -r b4e909a9ef0b services/crypto/nsSyncJPAKE.h
+--- a/services/crypto/nsSyncJPAKE.h	Wed Dec 15 08:45:58 2010 +0100
++++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
+@@ -1,65 +0,0 @@
+-/* ***** BEGIN LICENSE BLOCK *****
+- * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+- *
+- * The contents of this file are subject to the Mozilla Public License Version
+- * 1.1 (the "License"); you may not use this file except in compliance with
+- * the License. You may obtain a copy of the License at
+- * http://www.mozilla.org/MPL/
+- *
+- * Software distributed under the License is distributed on an "AS IS" basis,
+- * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+- * for the specific language governing rights and limitations under the
+- * License.
+- *
+- * The Original Code is Firefox Sync.
+- *
+- * The Initial Developer of the Original Code is
+- * the Mozilla Foundation.
+- * Portions created by the Initial Developer are Copyright (C) 2010
+- * the Initial Developer. All Rights Reserved.
+- *
+- * Contributor(s):
+- * Brian Smith <bsmith@mozilla.com>
+- * Philipp von Weitershausen <philipp@weitershausen.de>
+- *
+- * Alternatively, the contents of this file may be used under the terms of
+- * either the GNU General Public License Version 2 or later (the "GPL"), or
+- * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+- * in which case the provisions of the GPL or the LGPL are applicable instead
+- * of those above. If you wish to allow use of your version of this file only
+- * under the terms of either the GPL or the LGPL, and not to allow others to
+- * use your version of this file under the terms of the MPL, indicate your
+- * decision by deleting the provisions above and replace them with the notice
+- * and other provisions required by the GPL or the LGPL. If you do not delete
+- * the provisions above, a recipient may use your version of this file under
+- * the terms of any one of the MPL, the GPL or the LGPL.
+- *
+- * ***** END LICENSE BLOCK ***** */
+-#ifndef nsSyncJPAKE_h__
+-#define nsSyncJPAKE_h__
+-
+-#include "nsISyncJPAKE.h"
+-
+-#define NS_SYNCJPAKE_CONTRACTID \
+-  "@mozilla.org/services-crypto/sync-jpake;1"
+-
+-#define NS_SYNCJPAKE_CID \
+-  {0x0b9721c0, 0x1805, 0x47c3, {0x86, 0xce, 0x68, 0x13, 0x79, 0x5a, 0x78, 0x3f}}
+-
+-typedef struct PK11SymKeyStr PK11SymKey;
+-
+-class nsSyncJPAKE : public nsISyncJPAKE
+-{
+-public:
+-  NS_DECL_ISUPPORTS
+-  NS_DECL_NSISYNCJPAKE
+-  nsSyncJPAKE();
+-  virtual ~nsSyncJPAKE();
+-private:
+-  enum { JPAKENotStarted, JPAKEBeforeRound2, JPAKEAfterRound2 } round;
+-  PK11SymKey * key;
+-};
+-
+-NS_IMPL_ISUPPORTS1(nsSyncJPAKE, nsISyncJPAKE)
+-
+-#endif // nsSyncJPAKE_h__
+diff -r b4e909a9ef0b services/crypto/tests/unit/test_jpake.js
+--- a/services/crypto/tests/unit/test_jpake.js	Wed Dec 15 08:45:58 2010 +0100
++++ /dev/null	Thu Jan 01 00:00:00 1970 +0000
+@@ -1,194 +0,0 @@
+-// Ensure PSM is initialized.
+-Cc["@mozilla.org/psm;1"].getService(Ci.nsISupports);
+-
+-function do_check_throws(func) {
+-  let have_error = false;
+-  try {
+-    func();
+-  } catch(ex) {
+-    dump("Was expecting an exception. Caught: " + ex + "\n");
+-    have_error = true;
+-  }
+-  do_check_true(have_error);
+-}
+-
+-function test_success() {
+-  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-
+-  let a_gx1 = {};
+-  let a_gv1 = {};
+-  let a_r1 = {};
+-  let a_gx2 = {};
+-  let a_gv2 = {};
+-  let a_r2 = {};
+-
+-  let b_gx1 = {};
+-  let b_gv1 = {};
+-  let b_r1 = {};
+-  let b_gx2 = {};
+-  let b_gv2 = {};
+-  let b_r2 = {};
+-
+-  a.round1("alice", a_gx1, a_gv1, a_r1, a_gx2, a_gv2, a_r2);
+-  b.round1("bob", b_gx1, b_gv1, b_r1, b_gx2, b_gv2, b_r2);
+-
+-  let a_A = {};
+-  let a_gva = {};
+-  let a_ra = {};
+-
+-  let b_A = {};
+-  let b_gva = {};
+-  let b_ra = {};
+-
+-  a.round2("bob", "sekrit", b_gx1.value, b_gv1.value, b_r1.value,
+-           b_gx2.value, b_gv2.value, b_r2.value, a_A, a_gva, a_ra);
+-  b.round2("alice", "sekrit", a_gx1.value, a_gv1.value, a_r1.value,
+-           a_gx2.value, a_gv2.value, a_r2.value, b_A, b_gva, b_ra);
+-
+-  let a_aes = {};
+-  let a_hmac = {};
+-  let b_aes = {};
+-  let b_hmac = {};
+-
+-  a.final(b_A.value, b_gva.value, b_ra.value, "ohai", a_aes, a_hmac);
+-  b.final(a_A.value, a_gva.value, a_ra.value, "ohai", b_aes, b_hmac);
+-
+-  do_check_eq(a_aes.value, b_aes.value);
+-  do_check_eq(a_hmac.value, b_hmac.value);
+-}
+-
+-function test_failure(modlen) {
+-  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-
+-  let a_gx1 = {};
+-  let a_gv1 = {};
+-  let a_r1 = {};
+-  let a_gx2 = {};
+-  let a_gv2 = {};
+-  let a_r2 = {};
+-
+-  let b_gx1 = {};
+-  let b_gv1 = {};
+-  let b_r1 = {};
+-  let b_gx2 = {};
+-  let b_gv2 = {};
+-  let b_r2 = {};
+-
+-  a.round1("alice", a_gx1, a_gv1, a_r1, a_gx2, a_gv2, a_r2);
+-  b.round1("bob", b_gx1, b_gv1, b_r1, b_gx2, b_gv2, b_r2);
+-
+-  let a_A = {};
+-  let a_gva = {};
+-  let a_ra = {};
+-
+-  let b_A = {};
+-  let b_gva = {};
+-  let b_ra = {};
+-
+-  // Note how the PINs are different (secret vs. sekrit)
+-  a.round2("bob", "secret", b_gx1.value, b_gv1.value, b_r1.value,
+-           b_gx2.value, b_gv2.value, b_r2.value, a_A, a_gva, a_ra);
+-  b.round2("alice", "sekrit", a_gx1.value, a_gv1.value, a_r1.value,
+-           a_gx2.value, a_gv2.value, a_r2.value, b_A, b_gva, b_ra);
+-
+-  let a_aes = {};
+-  let a_hmac = {};
+-  let b_aes = {};
+-  let b_hmac = {};
+-
+-  a.final(b_A.value, b_gva.value, b_ra.value, "ohai", a_aes, a_hmac);
+-  b.final(a_A.value, a_gva.value, a_ra.value, "ohai", b_aes, b_hmac);
+-
+-  do_check_neq(a_aes.value, b_aes.value);
+-  do_check_neq(a_hmac.value, b_hmac.value);
+-}
+-
+-function test_same_signerids() {
+-  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-
+-  let gx1 = {};
+-  let gv1 = {};
+-  let r1 = {};
+-  let gx2 = {};
+-  let gv2 = {};
+-  let r2 = {};
+-
+-  a.round1("alice", {}, {}, {}, {}, {}, {});
+-  b.round1("alice", gx1, gv1, r1, gx2, gv2, r2);
+-  do_check_throws(function() {
+-    a.round2("alice", "sekrit", gx1.value, gv1.value, r1.value,
+-             gx2.value, gv2.value, r2.value, {}, {}, {});
+-  });
+-}
+-
+-function test_bad_zkp() {
+-  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-
+-  let gx1 = {};
+-  let gv1 = {};
+-  let r1 = {};
+-  let gx2 = {};
+-  let gv2 = {};
+-  let r2 = {};
+-
+-  a.round1("alice", {}, {}, {}, {}, {}, {});
+-  b.round1("bob", gx1, gv1, r1, gx2, gv2, r2);
+-  do_check_throws(function() {
+-    a.round2("invalid", "sekrit", gx1.value, gv1.value, r1.value,
+-             gx2.value, gv2.value, r2.value, {}, {}, {});
+-  });
+-}
+-
+-function test_invalid_input_round2() {
+-  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-
+-  a.round1("alice", {}, {}, {}, {}, {}, {});
+-  do_check_throws(function() {
+-    a.round2("invalid", "sekrit", "some", "real", "garbage",
+-             "even", "more", "garbage", {}, {}, {});
+-  });
+-}
+-
+-function test_invalid_input_final() {
+-  let a = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-  let b = Cc["@mozilla.org/services-crypto/sync-jpake;1"]
+-            .createInstance(Ci.nsISyncJPAKE);
+-
+-  let gx1 = {};
+-  let gv1 = {};
+-  let r1 = {};
+-  let gx2 = {};
+-  let gv2 = {};
+-  let r2 = {};
+-
+-  a.round1("alice", {}, {}, {}, {}, {}, {});
+-  b.round1("bob", gx1, gv1, r1, gx2, gv2, r2);
+-  a.round2("bob", "sekrit", gx1.value, gv1.value, r1.value,
+-           gx2.value, gv2.value, r2.value, {}, {}, {});
+-  do_check_throws(function() {
+-    a.final("some", "garbage", "alright", "foobar-info", {}, {});
+-  });
+-}
+-
+-function run_test() {
+-  test_success();
+-  test_failure();
+-  test_same_signerids();
+-  test_bad_zkp();
+-  test_invalid_input_round2();
+-  test_invalid_input_final();
+-}
+diff -r b4e909a9ef0b toolkit/library/libxul-config.mk
+--- a/toolkit/library/libxul-config.mk	Wed Dec 15 08:45:58 2010 +0100
++++ b/toolkit/library/libxul-config.mk	Wed Dec 15 11:18:35 2010 +0100
+@@ -345,19 +345,17 @@ DEFINES += -DMOZ_SPELLCHECK
+ COMPONENT_LIBS += spellchecker
+ endif
+ 
+ ifdef MOZ_ZIPWRITER
+ DEFINES += -DMOZ_ZIPWRITER
+ COMPONENT_LIBS += zipwriter
+ endif
+ 
+-ifdef MOZ_SERVICES_SYNC
+ COMPONENT_LIBS += services-crypto
+-endif
+ 
+ ifdef MOZ_DEBUG
+ ifdef ENABLE_TESTS
+ COMPONENT_LIBS += gkdebug
+ endif
+ endif
+ 
+ ifdef MOZ_APP_COMPONENT_LIBS
+diff -r b4e909a9ef0b toolkit/library/nsStaticXULComponents.cpp
+--- a/toolkit/library/nsStaticXULComponents.cpp	Wed Dec 15 08:45:58 2010 +0100
++++ b/toolkit/library/nsStaticXULComponents.cpp	Wed Dec 15 11:18:35 2010 +0100
+@@ -228,21 +228,17 @@
+ #endif
+ 
+ #if defined(BUILD_CTYPES)
+ #define JSCTYPES_MODULE MODULE(jsctypes)
+ #else
+ #define JSCTYPES_MODULE
+ #endif
+ 
+-#ifdef MOZ_SERVICES_SYNC
+ #define SERVICES_CRYPTO_MODULE MODULE(nsServicesCryptoModule)
+-#else
+-#define SERVICES_CRYPTO_MODULE
+-#endif
+ 
+ #if defined(MOZ_APP_COMPONENT_INCLUDE)
+ #include MOZ_APP_COMPONENT_INCLUDE
+ #else
+ #define APP_COMPONENT_MODULES
+ #endif
+ 
+ #define XUL_MODULES                          \
+diff -r b4e909a9ef0b toolkit/toolkit-tiers.mk
+--- a/toolkit/toolkit-tiers.mk	Wed Dec 15 08:45:58 2010 +0100
++++ b/toolkit/toolkit-tiers.mk	Wed Dec 15 11:18:35 2010 +0100
+@@ -230,19 +230,17 @@ tier_platform_dirs	+= security/manager
+ else
+ tier_platform_dirs	+= security/manager/boot/public security/manager/ssl/public
+ endif
+ 
+ ifdef MOZ_PREF_EXTENSIONS
+ tier_platform_dirs += extensions/pref
+ endif
+ 
+-ifdef MOZ_SERVICES_SYNC
+-tier_platform_dirs += services/crypto
+-endif
++tier_platform_dirs += services/crypto/component
+ 
+ # JavaXPCOM JNI code is compiled into libXUL
+ ifdef MOZ_JAVAXPCOM
+ tier_platform_dirs += extensions/java/xpcom/src
+ endif
+ 
+ ifndef BUILD_STATIC_LIBS
+ ifneq (,$(MOZ_ENABLE_GTK2))