pub enum SignCountVerdict {
NoBaseline,
NoCounter,
Increased,
Equal,
Decreased,
}Expand description
What a sign-count comparison says, independent of any policy.
WebAuthn L3 §7.2 step 18 is explicit that a counter which does not increase is “a signal, but not proof”, and it names one benign cause: “a race condition where the Relying Party is processing assertion responses in an order other than the order they were generated.” So the comparison itself yields a fact; what the relying party does about it is a separate decision, and this enum is the first half.
Variants§
NoBaseline
The stored counter was zero, so there is no baseline: first use, or an authenticator that has never signed.
NoCounter
The reported counter was zero, so the authenticator implements no counter and the assertion carries no freshness signal either way.
Increased
The counter strictly increased. Fresh.
Equal
The counter is unchanged — which is exactly what a replayed assertion looks like, since it carries the value the authenticator last wrote.
Decreased
The counter went backwards.