diff --git a/DEPS b/DEPS
index d11c3ce2ca2a82..5832c15f109f56 100644
--- a/DEPS
+++ b/DEPS
@@ -306,6 +306,9 @@ deps = {
   "src/third_party/libwebm/source":
     Var("chromium_git") +
       "/webm/libwebm.git@0f7815b036651e242ec8c2fcfb59fe54f69be1a8",
+
+  "src/third_party/openssl":
+    "/trunk/deps/third_party/openssl@" + Var("openssl_revision"),
 }
 
 
@@ -463,9 +466,6 @@ deps_os = {
       ((Var("googlecode_url") % "linux-syscall-support") + "/trunk/lss@" +
        Var("lss_revision")),
 
-    "src/third_party/openssl":
-      "/trunk/deps/third_party/openssl@" + Var("openssl_revision"),
-
     "src/third_party/gold":
       "/trunk/deps/third_party/gold@228995",
 
@@ -552,9 +552,6 @@ deps_os = {
       ((Var("googlecode_url") % "linux-syscall-support") + "/trunk/lss@" +
        Var("lss_revision")),
 
-    "src/third_party/openssl":
-      "/trunk/deps/third_party/openssl@" + Var("openssl_revision"),
-
     "src/third_party/eyesfree/src/android/java/src/com/googlecode/eyesfree/braille":
       (Var("googlecode_url") % "eyes-free") + "/trunk/braille/client/src/com/googlecode/eyesfree/braille@797",
 
diff --git a/build/common.gypi b/build/common.gypi
index 353d2762ce5ed0..7f5def0c403c18 100644
--- a/build/common.gypi
+++ b/build/common.gypi
@@ -2201,9 +2201,6 @@
       ['use_libjpeg_turbo==1', {
         'defines': ['USE_LIBJPEG_TURBO=1'],
       }],
-      ['use_nss==1', {
-        'defines': ['USE_NSS=1'],
-      }],
       ['use_x11==1', {
         'defines': ['USE_X11=1'],
       }],
@@ -2357,11 +2354,6 @@
           }],
         ],
       }],
-      ['use_openssl==1', {
-        'defines': [
-          'USE_OPENSSL=1',
-        ],
-      }],
       ['enable_eglimage==1', {
         'defines': [
           'ENABLE_EGLIMAGE=1',
@@ -2513,6 +2505,12 @@
       }],
     ],  # conditions for 'target_defaults'
     'target_conditions': [
+      ['<(use_openssl)==1 or >(nacl_untrusted_build)==1', {
+        'defines': ['USE_OPENSSL=1'],
+      }],
+      ['<(use_nss)==1 and >(nacl_untrusted_build)==0', {
+        'defines': ['USE_NSS=1'],
+      }],
       ['enable_wexit_time_destructors==1', {
         'conditions': [
           [ 'clang==1', {
diff --git a/crypto/crypto.gyp b/crypto/crypto.gyp
index cb71fb021f0ee1..95f02b38972fa2 100644
--- a/crypto/crypto.gyp
+++ b/crypto/crypto.gyp
@@ -5,20 +5,10 @@
 {
   'variables': {
     'chromium_code': 1,
-    # Put all transitive dependencies for Windows HMAC here.
-    # This is required so that we can build them for nacl win64.
-    'hmac_win64_related_sources': [
-      'hmac.cc',
-      'hmac.h',
-      'hmac_win.cc',
-      'secure_util.cc',
-      'secure_util.h',
-      'symmetric_key.h',
-      'symmetric_key_win.cc',
-      'third_party/nss/chromium-sha256.h',
-      'third_party/nss/sha512.cc',
-    ],
   },
+  'includes': [
+    'crypto.gypi',
+  ],
   'targets': [
     {
       'target_name': 'crypto',
@@ -163,83 +153,7 @@
         },],
       ],
       'sources': [
-        # NOTE: all transitive dependencies of HMAC on windows need
-        #     to be placed in the source list above.
-        '<@(hmac_win64_related_sources)',
-        'apple_keychain.h',
-        'apple_keychain_ios.mm',
-        'apple_keychain_mac.mm',
-        'capi_util.cc',
-        'capi_util.h',
-        'crypto_export.h',
-        'cssm_init.cc',
-        'cssm_init.h',
-        'curve25519.cc',
-        'curve25519.h',
-        'curve25519-donna.c',
-        'ghash.cc',
-        'ghash.h',
-        'ec_private_key.h',
-        'ec_private_key_nss.cc',
-        'ec_private_key_openssl.cc',
-        'ec_signature_creator.cc',
-        'ec_signature_creator.h',
-        'ec_signature_creator_impl.h',
-        'ec_signature_creator_nss.cc',
-        'ec_signature_creator_openssl.cc',
-        'encryptor.cc',
-        'encryptor.h',
-        'encryptor_nss.cc',
-        'encryptor_openssl.cc',
-        'hkdf.cc',
-        'hkdf.h',
-        'hmac_nss.cc',
-        'hmac_openssl.cc',
-        'mac_security_services_lock.cc',
-        'mac_security_services_lock.h',
-        'mock_apple_keychain.cc',
-        'mock_apple_keychain.h',
-        'mock_apple_keychain_ios.cc',
-        'mock_apple_keychain_mac.cc',
-        'p224_spake.cc',
-        'p224_spake.h',
-        'nss_crypto_module_delegate.h',
-        'nss_util.cc',
-        'nss_util.h',
-        'nss_util_internal.h',
-        'openpgp_symmetric_encryption.cc',
-        'openpgp_symmetric_encryption.h',
-        'openssl_util.cc',
-        'openssl_util.h',
-        'p224.cc',
-        'p224.h',
-        'random.h',
-        'random.cc',
-        'rsa_private_key.cc',
-        'rsa_private_key.h',
-        'rsa_private_key_nss.cc',
-        'rsa_private_key_openssl.cc',
-        'scoped_capi_types.h',
-        'scoped_nss_types.h',
-        'secure_hash.h',
-        'secure_hash_default.cc',
-        'secure_hash_openssl.cc',
-        'sha2.cc',
-        'sha2.h',
-        'signature_creator.h',
-        'signature_creator_nss.cc',
-        'signature_creator_openssl.cc',
-        'signature_verifier.h',
-        'signature_verifier_nss.cc',
-        'signature_verifier_openssl.cc',
-        'symmetric_key_nss.cc',
-        'symmetric_key_openssl.cc',
-        'third_party/nss/chromium-blapi.h',
-        'third_party/nss/chromium-blapit.h',
-        'third_party/nss/chromium-nss.h',
-        'third_party/nss/pk11akey.cc',
-        'third_party/nss/rsawrapr.c',
-        'third_party/nss/secsign.cc',
+        '<@(crypto_sources)',
       ],
     },
     {
diff --git a/crypto/crypto.gypi b/crypto/crypto.gypi
new file mode 100644
index 00000000000000..005921ee0a059b
--- /dev/null
+++ b/crypto/crypto.gypi
@@ -0,0 +1,103 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    # Put all transitive dependencies for Windows HMAC here.
+    # This is required so that we can build them for nacl win64.
+    'variables': {
+      'hmac_win64_related_sources': [
+        'hmac.cc',
+        'hmac.h',
+        'hmac_win.cc',
+        'secure_util.cc',
+        'secure_util.h',
+        'symmetric_key.h',
+        'symmetric_key_win.cc',
+        'third_party/nss/chromium-sha256.h',
+        'third_party/nss/sha512.cc',
+      ],
+    },
+    'hmac_win64_related_sources': [ '<@(hmac_win64_related_sources)' ],
+    'crypto_sources': [
+      # NOTE: all transitive dependencies of HMAC on windows need
+      #     to be placed in the source list above.
+      '<@(hmac_win64_related_sources)',
+      'apple_keychain.h',
+      'apple_keychain_ios.mm',
+      'apple_keychain_mac.mm',
+      'capi_util.cc',
+      'capi_util.h',
+      'crypto_export.h',
+      'cssm_init.cc',
+      'cssm_init.h',
+      'curve25519.cc',
+      'curve25519.h',
+      'curve25519-donna.c',
+      'ghash.cc',
+      'ghash.h',
+      'ec_private_key.h',
+      'ec_private_key_nss.cc',
+      'ec_private_key_openssl.cc',
+      'ec_signature_creator.cc',
+      'ec_signature_creator.h',
+      'ec_signature_creator_impl.h',
+      'ec_signature_creator_nss.cc',
+      'ec_signature_creator_openssl.cc',
+      'encryptor.cc',
+      'encryptor.h',
+      'encryptor_nss.cc',
+      'encryptor_openssl.cc',
+      'hkdf.cc',
+      'hkdf.h',
+      'hmac_nss.cc',
+      'hmac_openssl.cc',
+      'mac_security_services_lock.cc',
+      'mac_security_services_lock.h',
+      'mock_apple_keychain.cc',
+      'mock_apple_keychain.h',
+      'mock_apple_keychain_ios.cc',
+      'mock_apple_keychain_mac.cc',
+      'p224_spake.cc',
+      'p224_spake.h',
+      'nss_crypto_module_delegate.h',
+      'nss_util.cc',
+      'nss_util.h',
+      'nss_util_internal.h',
+      'openpgp_symmetric_encryption.cc',
+      'openpgp_symmetric_encryption.h',
+      'openssl_util.cc',
+      'openssl_util.h',
+      'p224.cc',
+      'p224.h',
+      'random.h',
+      'random.cc',
+      'rsa_private_key.cc',
+      'rsa_private_key.h',
+      'rsa_private_key_nss.cc',
+      'rsa_private_key_openssl.cc',
+      'scoped_capi_types.h',
+      'scoped_nss_types.h',
+      'secure_hash.h',
+      'secure_hash_default.cc',
+      'secure_hash_openssl.cc',
+      'sha2.cc',
+      'sha2.h',
+      'signature_creator.h',
+      'signature_creator_nss.cc',
+      'signature_creator_openssl.cc',
+      'signature_verifier.h',
+      'signature_verifier_nss.cc',
+      'signature_verifier_openssl.cc',
+      'symmetric_key_nss.cc',
+      'symmetric_key_openssl.cc',
+      'third_party/nss/chromium-blapi.h',
+      'third_party/nss/chromium-blapit.h',
+      'third_party/nss/chromium-nss.h',
+      'third_party/nss/pk11akey.cc',
+      'third_party/nss/rsawrapr.c',
+      'third_party/nss/secsign.cc',
+    ]
+  }
+}
diff --git a/crypto/crypto_nacl.gyp b/crypto/crypto_nacl.gyp
new file mode 100644
index 00000000000000..f43d7c3f7d9b56
--- /dev/null
+++ b/crypto/crypto_nacl.gyp
@@ -0,0 +1,48 @@
+# Copyright 2014 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+{
+  'variables': {
+    'chromium_code': 1,
+  },
+  'includes': [
+    '../native_client/build/untrusted.gypi',
+    'crypto.gypi',
+  ],
+  'targets': [
+    {
+      'target_name': 'crypto_nacl',
+      'type': 'none',
+      'variables': {
+        'nacl_untrusted_build': 1,
+        'nlib_target': 'libcrypto_nacl.a',
+        'build_glibc': 0,
+        'build_newlib': 0,
+        'build_pnacl_newlib': 1,
+      },
+      'dependencies': [
+        '../third_party/openssl/openssl_nacl.gyp:openssl_nacl',
+        '../native_client/tools.gyp:prep_toolchain',
+        '../native_client_sdk/native_client_sdk_untrusted.gyp:nacl_io_untrusted',
+      ],
+      'defines': [
+        'CRYPTO_IMPLEMENTATION',
+      ],
+      'sources': [
+        '<@(crypto_sources)',
+      ],
+      'sources/': [
+        ['exclude', '_nss\.(cc|h)$'],
+        ['exclude', '^(mock_)?apple_'],
+        ['exclude', '^capi_'],
+        ['exclude', '^openpgp_'],
+        ['exclude', '^cssm_'],
+        ['exclude', '^nss_'],
+        ['exclude', '^mac_'],
+        ['exclude', '^third_party/nss/'],
+        ['include', '^third_party/nss/sha512.cc'],
+      ],
+    },
+  ],
+}