code: func (reg *Registration) Authenticate(resp SignResponse, c Challenge, counter uint32) (newCounter uint32, err error) {
  	if time.Now().Sub(c.Timestamp) > timeout {
  		return 0, errors.New("u2f: challenge has expired")
  	}
  	if resp.KeyHandle != encodeBase64(reg.KeyHandle) {
  		return 0, errors.New("u2f: wrong key handle")
  	}
  
  	sigData, err := decodeBase64(resp.SignatureData)
  	if err != nil {
  		return 0, err
  	}
  
  	clientData, err := decodeBase64(resp.ClientData)
  	if err != nil {
  		return 0, err
  	}
  
  	ar, err := parseSignResponse(sigData)
  	if err != nil {
  		return 0, err
  	}
  
  	if ar.Counter < counter {
  		return 0, ErrCounterTooLow
  	}
  
  	if err := verifyClientData(clientData, c); err != nil {
  		return 0, err
  	}
  
  	if err := verifyAuthSignature(*ar, &reg.PubKey, c.AppID, clientData); err != nil {
  		return 0, err
  	}
  
  	if !ar.UserPresenceVerified {
  		return 0, errors.New("u2f: user was not present")
  	}
  
  	return ar.Counter, nil
  }
docs: // Authenticate validates a SignResponse authentication response.
  // An error is returned if any part of the response fails to validate.
  // The counter should be the counter associated with appropriate device
  // (i.e. resp.KeyHandle).
  // The latest counter value is returned, which the caller should store.