dainnilsson
commented
2 years ago Hello!
It is difficult to determine a single check that would be universally useful for this. You could only check that the counter is always incrementing, but that will not stop a duplicate credential from being used, as the attacker would just ensure a very high value to avoid detection. You could allow an interval to try to prevent too big jumps, but then who is to say what is a reasonable range. There's also a big variation in how these counters are implemented by Authenticators. Some use a single counter for all credentials, others may use individual counters. Some use a unix timestamp, etc.
Because of these issues, we don't implement any checking of this value in the library. This avoids the risk of breaking any legitimate Authenticator that is acting in a way we haven't expected, and doesn't force any specific semantics onto the RP that may not be wanted.
We do expose the counter value via the API, so an implementer is able to implement any logic they want to for such a check.
Why is there no signature counter check as per FIDO standard?