Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Mention constant-zero case in §6.1.1 Signature Counter Considerations #1736

Merged
merged 2 commits into from
Jun 9, 2022
Merged

Mention constant-zero case in §6.1.1 Signature Counter Considerations #1736

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f9ccf45
Mention constant-zero signature counter in §6.1.1 Signature Counter C…
emlun May 29, 2022
7438029
Make a normative-looking "may" actually normative "MAY"
emlun May 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3620,6 +3620,9 @@ value of the [=authenticator data=] returned by [=authenticatorMakeCredential=].
[=authenticator data=] again. The [=signature counter=]'s purpose is to aid [=[RPS]=] in detecting cloned authenticators. Clone
detection is more important for authenticators with limited protection measures.

Authenticators that do not implement a [=signature counter=]
leave the <code>[=signCount=]</code> in the [=authenticator data=] constant at zero.

A [=[RP]=] stores the [=signature counter=] of the most recent [=authenticatorGetAssertion=] operation. (Or the counter from the [=authenticatorMakeCredential=] operation if no [=authenticatorGetAssertion=] has ever been performed on a credential.) In subsequent
[=authenticatorGetAssertion=] operations, the [=[RP]=] compares the stored [=signature counter=] value with the new
<code>[=signCount=]</code> value returned in the assertion's [=authenticator data=]. If either is non-zero, and the new <code>[=signCount=]</code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.
Expand All @@ -3629,7 +3632,7 @@ Detecting a [=signature counter=] mismatch does not indicate whether the current
Authenticators:
- SHOULD implement per credential [=signature counters=]. This prevents the
[=signature counter=] value from being shared between [=[RPS]=] and being possibly employed
as a correlation handle for the user. Authenticators may implement a global [=signature counter=],
as a correlation handle for the user. Authenticators MAY implement a global [=signature counter=],
i.e., on a per-authenticator basis, but this is less privacy-friendly for users.

- SHOULD ensure that the [=signature counter=] value does not
Expand Down