My question is about the U2F protocol and more precisely cloning detection. According to the doc :
"If there is a possibility that a U2F token can be cloned, we also need some way to detect it. We can do this by having an operation counter. Every time a cryptographic operation is performed, the counter increases by 1. The value of the counter is signed and sent as part of the response to the relying party, which stores the value of the counter in its database. If the counter value in a future authentication response is less than the counter value stored by relying party, then the token has been cloned, and the relying party must decline the authentication request. It should probably also log the event occurrence and/or perform necessary actions to secure the user, by for example blocking token from further authentication attempts."
Why the counter value in a future authentication response would be less than the counter value stored by a relying party ? If an attacker has cloned the device, he has access to the current counter value stored in the original device, isn't it ? He could then send a counter value bigger than the counter stored in the database of the relying party, and the device will not be marked as compromised.
I'm certainly wrong but I am just wondering.
Thanks you in advance !