From a3ee89d091b483c20428bd538c7a4e271ab406b7 Mon Sep 17 00:00:00 2001
From: Robin Krahl <robin@nitrokey.com>
Date: Sun, 31 May 2026 15:03:59 +0200
Subject: [PATCH] Handle signature counter overflows

As described in Requirement 2.3.2 of the Security Requirements v1.5, a
signature counter value of zero indicates an error. If the authenticator
returns zero once, it may not return a non-zero value in subsequent
calls, so we have to stay in the error state if an overflow occurs.
---
 CHANGELOG.md |  1 +
 src/state.rs | 14 ++++++++++++--
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56eb092..7f58040 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Fix signature counter to improve spec compliance:
   - Set the initial signature counter to 1.
+  - Correctly handle signature counter overflows by returning 0.
 
 ## [v0.4.0-rc.1](https://github.com/trussed-dev/fido-authenticator/releases/tag/v0.4.0-rc.1) (2026-05-29)
 
diff --git a/src/state.rs b/src/state.rs
index a10a7ef..480412d 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -397,8 +397,18 @@ impl PersistentState {
 
     pub fn signature_counter<T: FilesystemClient>(&mut self, trussed: &mut T) -> Result<u32> {
         let now = self.timestamp;
-        self.timestamp += 1;
-        self.save(trussed)?;
+        // 0 indicates a counter overflow. If this is the case, we can no longer increment the
+        // counter and have to always return 0, see Requirement 2.3.2 in the Security Requirements
+        // v1.5.
+        if now > 0 {
+            if let Some(timestamp) = self.timestamp.checked_add(1) {
+                self.timestamp = timestamp;
+            } else {
+                // Indicate an overflow by setting the counter to 0.
+                self.timestamp = 0;
+            }
+            self.save(trussed)?;
+        }
         Ok(now)
     }