Increment signature counter by a random number

As defined in Requirement 2.3.2 of the Security Requirements v1.5, we
have to use a random (positive) increment for a global signature
counter. This patch uses a random u8 + 1. As the signature counter is a
u32, this still gives us more than 16 million operations until the
counter can potentially overflow.

src/state.rs

@@ -395,13 +395,21 @@ impl PersistentState {
         }
     }
 
-    pub fn signature_counter<T: FilesystemClient>(&mut self, trussed: &mut T) -> Result<u32> {
+    pub fn signature_counter<T: CryptoClient + FilesystemClient>(
+        &mut self,
+        trussed: &mut T,
+    ) -> Result<u32> {
         let now = self.timestamp;
         // 0 indicates a counter overflow. If this is the case, we can no longer increment the
         // counter and have to always return 0, see Requirement 2.3.2 in the Security Requirements
         // v1.5.
         if now > 0 {
-            if let Some(timestamp) = self.timestamp.checked_add(1) {
+            // As we use a global signature counter, we have to increment it by a random (positive)
+            // number to ensure that it cannot be used to correlate authenticators.
+            // The signature counter is a u32, so incrementing it by at most 256 still gives us plenty
+            // of time until the counter overflows.
+            let increment = syscall!(trussed.random_bytes(1)).bytes[0];
+            if let Some(timestamp) = self.timestamp.checked_add(u32::from(increment) + 1) {
                 self.timestamp = timestamp;
             } else {
                 // Indicate an overflow by setting the counter to 0.