Support for low-entropy passcodes similar to Android Weaver

[DemiMarie]

Weaver is Android’s framework for secure password authentication. Android provides the Weaver token with both a secret and a key (hashed password), and the key must be provided to obtain the secret from Weaver. A non-bypassable backoff system, such as binary exponential backoff, is used to prevent brute-force attacks on the password.

Implementing this does not require a Real-Time Clock (RTC). A timer that counts time since power on is sufficient, provided that:

1. Power failure or hardware reset resets the timeout to zero, unless the time has fully elapsed. In other words, the requirement is “the device must be powered on for X amount of time”.
2. The timer cannot be bypassed except by tampering with Fobnail’s secure element.
3. It is not possible for a power glitch to prevent the failed attempt counter from being updated. This means that the failed attempt counter must be updated before checking the password.