Support for validating signature counter?

[xi]

See https://www.w3.org/TR/webauthn/#signature-counter

The signature counter is incremented for each successful authenticatorGetAssertion operation by some positive value, and subsequent values are returned to the WebAuthn Relying Party within the authenticator data again. The signature counter's purpose is to aid Relying Parties in detecting cloned authenticators. Clone detection is more important for authenticators with limited protection measures.

A Relying Party stores the signature counter of the most recent authenticatorGetAssertion operation. (Or the counter from the authenticatorMakeCredential operation if no authenticatorGetAssertion has ever been performed on a credential.) In subsequent authenticatorGetAssertion operations, the Relying Party compares the stored signature counter value with the new signCount value returned in the assertion’s authenticator data. If either is non-zero, and the new signCount value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.

This could be implemented by adding AttestedCredentialData.sign_count: int and checking it in Fido2Server.authenticate_complete(). For backwards compatibility, the default value could be None.

In addition to that, the application would have to store the new count for the chosen credential, so AuthenticatorData.counter needs to be communicated back to the caller. Currently, only the credential is returned from authenticate_complete(). A simple option would be to set cred.sign_count = auth_data.counter. However, AttestedCredentialData is a frozen dataclass, so it cannot be modified.

However, I am not 100% sure this is even relevant. Multi-device credentials are gaining popularity. And it is also not clear how applications should react when they encounter a non-monotonic signature count. For further discussion, see https://www.imperialviolet.org/tourofwebauthn/tourofwebauthn.html#signature-counters

What do you think about this?

[dainnilsson]

I'd say that how you validate the counter, or if you should validate it at all is out of scope for this library (just as how you store credentials, etc. is up to the library user). Thus, I think that outside of making the counter accessible, there's probably not a lot we would want to do.

You've identified that getting the counter isn't trivial with the current design of the server class, since the return value is "only" the AttestedCredentialData and not the full response. However, you still have access to all parts of the response since that is what you are providing as input. The dataclasses in the library give you everything you need to do something like:

authentication = AuthenticationResponse.from_dict(response)
ensure_counter_valid(authentication.response.authenticator_data.counter)
server.authenticate_complete(authenticator)