From 30c37bf4129dc6f1a77e080447cfbd53dae368f8 Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Sun, 31 May 2026 14:40:56 +0200
Subject: [PATCH] Rename timestamp to signature_counter

---
 src/ctap1.rs | 4 ++--
 src/ctap2.rs | 6 +++---
 src/state.rs | 6 ++----
 3 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/src/ctap1.rs b/src/ctap1.rs
index 35092f3..7a0a478 100644
--- a/src/ctap1.rs
+++ b/src/ctap1.rs
@@ -87,7 +87,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
             creation_time: self
                 .state
                 .persistent
-                .timestamp(&mut self.trussed)
+                .signature_counter(&mut self.trussed)
                 .map_err(|_| Error::NotEnoughMemory)?,
             use_counter: true,
             algorithm: SigningAlgorithm::P256 as i32,
@@ -225,7 +225,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
         let sig_count = self
             .state
             .persistent
-            .timestamp(&mut self.trussed)
+            .signature_counter(&mut self.trussed)
             .map_err(|_| Error::UnspecifiedNonpersistentExecutionError)?;
 
         let mut commitment = Commitment::new();
diff --git a/src/ctap2.rs b/src/ctap2.rs
index f2c89b4..b143187 100644
--- a/src/ctap2.rs
+++ b/src/ctap2.rs
@@ -449,7 +449,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
             &parameters.user,
             algorithm as i32,
             key_parameter,
-            self.state.persistent.timestamp(&mut self.trussed)?,
+            self.state.persistent.signature_counter(&mut self.trussed)?,
             hmac_secret_requested,
             cred_protect_requested,
             large_blob_key,
@@ -526,7 +526,7 @@ impl<UP: UserPresence, T: TrussedRequirements> Authenticator for crate::Authenti
                 flags
             },
 
-            sign_count: self.state.persistent.timestamp(&mut self.trussed)?,
+            sign_count: self.state.persistent.signature_counter(&mut self.trussed)?,
 
             attested_credential_data: {
                 // debug_now!("acd in, cid len {}, pk len {}", credential_id.0.len(), cose_public_key.len());
@@ -2100,7 +2100,7 @@ impl<UP: UserPresence, T: TrussedRequirements> crate::Authenticator<UP, T> {
 
         use ctap2::AuthenticatorDataFlags as Flags;
 
-        let sig_count = self.state.persistent.timestamp(&mut self.trussed)?;
+        let sig_count = self.state.persistent.signature_counter(&mut self.trussed)?;
 
         let authenticator_data = ctap2::get_assertion::AuthenticatorData {
             rp_id_hash,
diff --git a/src/state.rs b/src/state.rs
index 7ce6493..568370c 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -278,9 +278,7 @@ pub struct PersistentState {
     /// a PIN change on the next `setMinPINLength` with a non-zero floor).
     #[serde(default)]
     pin_code_point_length: u8,
-    // Ideally, we'd dogfood a "Monotonic Counter" from trussed.
-    // TODO: Add per-key counters for resident keys.
-    // counter: Option<CounterId>,
+    /// Global signature counter.
     timestamp: u32,
 
     /// Configured minimum PIN length (CTAP 2.1 `setMinPINLength`, §6.11.4
@@ -392,7 +390,7 @@ impl PersistentState {
         }
     }
 
-    pub fn timestamp<T: FilesystemClient>(&mut self, trussed: &mut T) -> Result<u32> {
+    pub fn signature_counter<T: FilesystemClient>(&mut self, trussed: &mut T) -> Result<u32> {
         let now = self.timestamp;
         self.timestamp += 1;
         self.save(trussed)?;