diff --git a/index.bs b/index.bs index b1d55a2fa..19975144b 100644 --- a/index.bs +++ b/index.bs @@ -4811,7 +4811,9 @@ leave the [=authData/signCount=] in the [=authenticator data=] cons A [=[RP]=] stores the [=signature counter=] of the most recent [=authenticatorGetAssertion=] operation. (Or the counter from the [=authenticatorMakeCredential=] operation if no [=authenticatorGetAssertion=] has ever been performed on a credential.) In subsequent [=authenticatorGetAssertion=] operations, the [=[RP]=] compares the stored [=signature counter=] value with the new -[=authData/signCount=] value returned in the assertion's [=authenticator data=]. If either is non-zero, and the new [=authData/signCount=] value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning, or a race condition might exist where the relying party is receiving and processing assertions in an order other than the order they were generated at the authenticator. +[=authData/signCount=] value returned in the assertion's [=authenticator data=]. If either is non-zero, and the new [=authData/signCount=] value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning, +or a race condition might exist where the relying party is receiving and processing assertions +in an order other than the order they were generated at the authenticator. Detecting a [=signature counter=] mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. [=[RPS]=] should address this situation appropriately relative to their individual situations, i.e., their risk tolerance or operational factors that might result in an acceptable reason for non-increasing values.