anchor.diff:      with | _ -> failwith "writeSecretKeysToDisk failed"
   
       let sk = readSecretKeysFromDisk None |> JsonValue.Parse
  -    let sk_pl' = (sk?payload).AsString() |> JsonValue.Parse
  -
  -    let sk_pl = { iv         = (sk_pl'?IV).AsString()
  -                  ciphertext = (sk_pl'?ciphertext).AsString()
  -                  hmac       = (sk_pl'?hmac).AsString() }
  -
  +    let sk_pl = (sk?payload).AsString() |> JsonValue.Parse
  +
  +// https://docs.services.mozilla.com/sync/storageformat5.html
  +//
  +//    ciphertext  = record.ciphertext
  +//    iv          = record.iv
  +//    record_hmac = record.hmac
  +//
  +//    encryption_key = bundle.encryption_key
  +//    hmac_key       = bundle.hmac_key
  +//
  +//    local_hmac = HMACSHA256(hmac_key, base64(ciphertext))
  +//
  +//    if local_hmac != record_hmac:
  +//      throw Error("HMAC verification failed.")
  +//
  +//    cleartext = AESDecrypt(ciphertext, encryption_key, iv)
  +
  +    let record = { iv         = (sk_pl?IV).AsString()
  +                   ciphertext = (sk_pl?ciphertext).AsString()
  +                   hmac       = (sk_pl?hmac).AsString() }
  +
  +    let bundle = syncKeyBundle secrets.username (secrets.encryptionpassphrase |> base32Decode)
  +
  +    let local_hmac = record.ciphertext |> Convert.FromBase64String |> (new HMACSHA256(bundle.hmac_key)).ComputeHash
  +
  +    let cleartext = DecryptAES record.ciphertext bundle.encryption_key (record.iv |> Convert.FromBase64String)
  
positive.code:         let url = (clusterURL username) + "1.1/" + username + "/storage/crypto/keys"
          fetchUrlResponse url "GET" (Some (username, password)) None None None
  
  
      // decrypt payload
      // https://docs.services.mozilla.com/sync/storageformat5.html
      type CryptoKeysPayload = { iv         : string
                                 ciphertext : string
                                 hmac       : string }
  
  
      let writeSecretKeysToDisk username password (file : string option) = 
          let secretKeys = fetchCryptoKeys username password
  
negative.code:     //    # Second round of HKDF
      //    hmac = HKDF-Expand(sync_key, encryption_key + info + "\x02", 32)
      //      -> 0xbf9e48ac50a2fcc400ae4d30a58dc6a83a7720c32f58c60fd9d02db16e406216
      //                                                 
      let ff_skb' = syncKeyBundle "johndoe@example.com" ("Y4NKPS6YXAVI75XNUVODSR472I" |> base32Decode)
      let ff_skb'' = ( ff_skb'.encryption_key |> Array.map (sprintf "%x"), 
                       ff_skb'.hmac_key |> Array.map (sprintf "%x"))
      let ff_skb''' = ([|"8d"; "7"; "65"; "43"; "e"; "a0"; "d9"; "db"; "d5"; "3c"; "53"; "6c";
                         "6c"; "5c"; "4c"; "b6"; "39"; "c0"; "93"; "7"; "5e"; "f2"; "bd"; "77";
                         "cd"; "30"; "cf"; "48"; "51"; "38"; "b9"; "5"|],
  