@anonympins/fingerprint 0.4.5 → 0.5.0

package/src/php/Challenge/ChallengeUtils.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace Anonympins\Fingerprint\Challenge;
 
 use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\FingerprintBuilder;
 use Anonympins\Fingerprint\Utils\BigInt;
 use Anonympins\Fingerprint\Utils\RequestUtils;
 
@@ -23,6 +24,235 @@ class ChallengeUtils
         '/.git/config_{RANDOM}'
     ];
 
+    private static function imul(int $a, int $b): int
+    {
+        $ah = ($a >> 16) & 0xffff;
+        $al = $a & 0xffff;
+        $bh = ($b >> 16) & 0xffff;
+        $bl = $b & 0xffff;
+        $lo = $al * $bl;
+        $hi = (($lo >> 16) + ($al * $bh) + ($ah * $bl)) & 0xffff;
+        return (($hi << 16) | ($lo & 0xffff)) | 0;
+    }
+
+    private static function generateBlock(string $seed, int $blockIndex, int $blockSize = 1024): string
+    {
+        $block = str_repeat("\x00", $blockSize);
+        $h = FingerprintBuilder::cyrb53($seed . ":" . $blockIndex);
+        
+        $h_int = (int)bcmod($h, '4294967296');
+        for ($i = 0; $i < $blockSize; $i++) {
+            $h_int = self::imul($h_int ^ $i, 1597334677);
+            $block[$i] = chr($h_int & 0xff);
+        }
+        return $block;
+    }
+
+    public static function registerCooperativeNode(string $clientIp, string $nodeId, string $seed): void
+    {
+        $subnet = RequestUtils::getIpSubnet($clientIp);
+        if ($subnet === null) {
+            return;
+        }
+        $store = StoreManager::getStore();
+        $key = "coop-pospace:subnet:{$subnet}";
+        $nodes = $store->get($key) ?? [];
+        
+        $now = time();
+        // Nettoyage des nœuds expirés (vieux de plus de 2 minutes)
+        $nodes = array_filter($nodes, fn($n) => ($now - $n['timestamp']) < 120);
+        
+        $nodes[$nodeId] = [
+            'nodeId' => $nodeId,
+            'seed' => $seed,
+            'timestamp' => $now
+        ];
+        
+        $store->set($key, $nodes, 120);
+    }
+
+    public static function findPeerInSubnet(string $clientIp, string $excludeNodeId): ?array
+    {
+        $subnet = RequestUtils::getIpSubnet($clientIp);
+        if ($subnet === null) {
+            return null;
+        }
+        $store = StoreManager::getStore();
+        $key = "coop-pospace:subnet:{$subnet}";
+        $nodes = $store->get($key) ?? [];
+        
+        $now = time();
+        $activePeers = [];
+        foreach ($nodes as $id => $node) {
+            if ($id !== $excludeNodeId && ($now - $node['timestamp']) < 120) {
+                $activePeers[] = $node;
+            }
+        }
+        
+        if (empty($activePeers)) {
+            return null;
+        }
+        
+        return $activePeers[array_rand($activePeers)];
+    }
+
+    public static function handleCooperativeRequest(array $params): ?array
+    {
+        $op = $params['coop_op'] ?? null;
+        if (!$op) {
+            return null;
+        }
+
+        $store = StoreManager::getStore();
+        $nodeId = $params['node_id'] ?? '';
+        if (empty($nodeId)) {
+            return ['error' => 'Missing node_id'];
+        }
+
+        switch ($op) {
+            case 'register':
+                $clientIp = $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1';
+                $seed = $params['seed'] ?? '';
+                self::registerCooperativeNode($clientIp, $nodeId, $seed);
+                return ['status' => 'registered'];
+
+            case 'request_peer_block':
+                $peerId = $params['peer_id'] ?? '';
+                $blockIdx = (int)($params['block_idx'] ?? 0);
+                $requestId = $params['req_id'] ?? '';
+                if (empty($peerId) || empty($requestId)) {
+                    return ['error' => 'Invalid parameters'];
+                }
+                
+                $queueKey = "coop-mailbox:queue:{$peerId}";
+                $requests = $store->get($queueKey) ?? [];
+                $requests[] = [
+                    'req_id' => $requestId,
+                    'requester_id' => $nodeId,
+                    'block_idx' => $blockIdx
+                ];
+                $store->set($queueKey, $requests, 30);
+                return ['status' => 'queued'];
+
+            case 'poll_requests':
+                $queueKey = "coop-mailbox:queue:{$nodeId}";
+                $requests = $store->get($queueKey) ?? [];
+                $store->delete($queueKey);
+                return ['requests' => $requests];
+
+            case 'respond_block':
+                $requesterId = $params['requester_id'] ?? '';
+                $requestId = $params['req_id'] ?? '';
+                $blockData = $params['block_data'] ?? '';
+                if (empty($requesterId) || empty($requestId)) {
+                    return ['error' => 'Invalid parameters'];
+                }
+                
+                $responseKey = "coop-mailbox:res:{$requesterId}:{$requestId}";
+                $store->set($responseKey, ['block_data' => $blockData], 30);
+                return ['status' => 'delivered'];
+
+            case 'poll_response':
+                $requestId = $params['req_id'] ?? '';
+                $responseKey = "coop-mailbox:res:{$nodeId}:{$requestId}";
+                $data = $store->get($responseKey);
+                if ($data) {
+                    $store->delete($responseKey);
+                    return ['status' => 'ready', 'block_data' => $data['block_data']];
+                }
+                return ['status' => 'pending'];
+        }
+        return null;
+    }
+
+    public static function generateSpaceChallenge(string $clientIp, string $nonce, float $suspicionFactor, string $originalUrl, array $securityConfig): array
+    {
+        $pospaceConfig = $securityConfig['pospace'] ?? [];
+        $sizeMb = $pospaceConfig['sizeMb'] ?? 100;
+        $numQueries = $pospaceConfig['numQueries'] ?? 10;
+
+        $queries = [];
+        $maxBlocks = $sizeMb * 1024;
+        while (count($queries) < $numQueries) {
+            $idx = random_int(0, $maxBlocks - 1);
+            if (!in_array($idx, $queries, true)) {
+                $queries[] = $idx;
+            }
+        }
+
+        $challenge = [
+            'type' => 'pospace',
+            'nonce' => $nonce,
+            'sizeMb' => $sizeMb,
+            'queries' => $queries,
+            'path' => $originalUrl
+        ];
+
+        // Tentative de couplage coopératif avec un nœud du même sous-réseau
+        $peer = self::findPeerInSubnet($clientIp, $nonce);
+        if ($peer !== null) {
+            $challenge['peerId'] = $peer['nodeId'];
+            $challenge['peerBlockIdx'] = random_int(0, $maxBlocks - 1);
+            
+            $store = StoreManager::getStore();
+            $store->set("coop-assoc:{$nonce}", [
+                'peerNodeId' => $peer['nodeId'],
+                'peerSeed' => $peer['seed'],
+                'peerBlockIdx' => $challenge['peerBlockIdx']
+            ], 120);
+        }
+
+        return $challenge;
+    }
+
+    public static function verifySpacePoW(string $nonce, string $solution, array $queries, string $seed, string $clientSecret): bool
+    {
+        $combined = '';
+        foreach ($queries as $idx) {
+            $combined .= self::generateBlock($seed, (int)$idx);
+        }
+        
+        // Vérification de la preuve coopérative
+        $store = StoreManager::getStore();
+        $assoc = $store->get("coop-assoc:{$nonce}");
+        if ($assoc !== null) {
+            $peerSeed = $assoc['peerSeed'] ?? null;
+            $peerBlockIdx = $assoc['peerBlockIdx'] ?? null;
+            if ($peerSeed !== null && $peerBlockIdx !== null) {
+                $combined .= self::generateBlock($peerSeed, (int)$peerBlockIdx);
+            }
+            $store->delete("coop-assoc:{$nonce}");
+        }
+
+        $finalBlock = $combined . $nonce . ":" . $clientSecret;
+        $hash = hash('sha256', $finalBlock);
+        return hash_equals($hash, $solution);
+    }
+
+    public static function verifyZkpProof(string $yStr, string $tStr, string $sStr): bool
+    {
+        try {
+            $p = BigInt::fromHex('fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'); // secp256k1 prime
+            $g = new BigInt(2);
+
+            $y = BigInt::fromHex($yStr);
+            $t = BigInt::fromHex($tStr);
+            $s = BigInt::fromHex($sStr);
+
+            $cStr = (string)$g . (string)$y . (string)$t;
+            $cHex = hash('sha256', $cStr);
+            $c = BigInt::fromHex($cHex)->mod($p);
+
+            $left = $g->modPow($s, $p);
+            $y_c = $y->modPow($c, $p);
+            $right = $t->mul($y_c)->mod($p);
+
+            return $left->compareTo($right) === 0;
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
     /**
      * Récupère la clé secrète pour les PoW depuis les variables d'environnement.
      */
@@ -42,6 +272,22 @@ class ChallengeUtils
      */
     public static function generateStatelessTicket(array $payload): string
     {
+        $ed25519Key = $_ENV['ED25519_PRIVATE_KEY'] ?? getenv('ED25519_PRIVATE_KEY');
+        if ($ed25519Key) {
+            try {
+                $serialized = json_encode($payload);
+                $privateKey = openssl_pkey_get_private($ed25519Key);
+                if ($privateKey && openssl_sign($serialized, $signature, $privateKey, null)) {
+                    $base64UrlEncode = function ($input) {
+                        return rtrim(strtr(base64_encode($input), '+/', '-_'), '=');
+                    };
+                    return 'ed25519.' . $base64UrlEncode($serialized) . '.' . $base64UrlEncode($signature);
+                }
+            } catch (\Throwable $e) {
+                error_log("[ChallengeUtils] Ed25519 signing failed: " . $e->getMessage());
+            }
+        }
+
         $key = hash('sha256', self::getPowSecret(), true);
         $iv = random_bytes(16);
         $encrypted = openssl_encrypt(json_encode($payload), 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
@@ -55,10 +301,40 @@ class ChallengeUtils
     /**
      * Décode et valide un ticket stateless chiffré et signé.
      * @param string $ticket
+     * @param string $secret
      * @return array|null
      */
-    public static function parseStatelessTicket(string $ticket): ?array
+    public static function parseStatelessTicket(string $ticket, string $secret = ''): ?array
     {
+        try {
+            if (str_starts_with($ticket, 'ed25519.')) {
+                $parts = explode('.', $ticket);
+                if (count($parts) !== 3) {
+                    return null;
+                }
+                $base64UrlDecode = function ($input) {
+                    return base64_decode(strtr($input, '-_', '+/'));
+                };
+                $payloadJson = $base64UrlDecode($parts[1]);
+                $signature = $base64UrlDecode($parts[2]);
+                
+                $ed25519PubKey = $_ENV['ED25519_PUBLIC_KEY'] ?? getenv('ED25519_PUBLIC_KEY');
+                if (!$ed25519PubKey) {
+                    error_log("[ChallengeUtils] ED25519_PUBLIC_KEY is not defined in environment.");
+                    return null;
+                }
+                
+                $publicKey = openssl_pkey_get_public($ed25519PubKey);
+                if ($publicKey && openssl_verify($payloadJson, $signature, $publicKey, null) === 1) {
+                    return json_decode($payloadJson, true);
+                }
+                return null;
+            }
+        } catch (\Throwable $e) {
+            error_log("[ChallengeUtils] Ed25519 verification failed: " . $e->getMessage());
+            return null;
+        }
+
         $parts = explode('.', $ticket);
         if (count($parts) !== 3) {
             return null;
@@ -72,7 +348,7 @@ class ChallengeUtils
         if (!$iv || !$encrypted || !$signature || strlen($iv) !== 16) {
             return null;
         }
-        $key = hash('sha256', self::getPowSecret(), true);
+        $key = hash('sha256', !empty($secret) ? $secret : self::getPowSecret(), true);
         $expectedSignature = hash_hmac('sha256', $iv . $encrypted, $key, true);
         if (!hash_equals($expectedSignature, $signature)) {
             return null;
@@ -83,20 +359,23 @@ class ChallengeUtils
 
     /**
      * Vérifie si un ticket de passage est valide (supporte les tickets opaques via store et le fallback legacy).
+     * Supporte une clé secrète optionnelle passée en paramètre pour la compatibilité avec les tests.
      */
     public static function isTicketValid(
         ?string $ip,
         ?string $ticket,
         string $deviceId = '',
         string $deviceHash = '',
-        bool $allowCrossNetworkRoaming = false
+        bool $allowCrossNetworkRoaming = false,
+        string $secret = '',
+        string $zkpProof = ''
     ): bool {
         if (empty($ip) || empty($ticket)) {
             return false;
         }
 
         // Tentative de validation stateless d'abord
-        $ticketData = self::parseStatelessTicket($ticket);
+        $ticketData = self::parseStatelessTicket($ticket, $secret);
         if ($ticketData !== null) {
             $expiry = $ticketData['expiry'] ?? null;
             $originalIp = $ticketData['originalIp'] ?? null;
@@ -106,6 +385,18 @@ class ChallengeUtils
             if (!$expiry || (int)floor(microtime(true) * 1000) > (int)$expiry) {
                 return false;
             }
+                if ($storedDeviceHash && str_starts_with($storedDeviceHash, 'zkp:')) {
+                    $expectedY = explode(':', $storedDeviceHash, 2)[1] ?? '';
+                    if (!empty($zkpProof)) {
+                        $zkpParts = explode(':', $zkpProof);
+                        if (count($zkpParts) === 3 && $zkpParts[0] === $expectedY) {
+                            if (self::verifyZkpProof($zkpParts[0], $zkpParts[1], $zkpParts[2])) {
+                                return true;
+                            }
+                        }
+                    }
+                    return false;
+                }
             if ($ip === $originalIp) {
                 return true;
             }
@@ -133,6 +424,18 @@ class ChallengeUtils
                 $store->delete("ticket:{$ticket}");
                 return false;
             }
+                if ($storedDeviceHash && str_starts_with($storedDeviceHash, 'zkp:')) {
+                    $expectedY = explode(':', $storedDeviceHash, 2)[1] ?? '';
+                    if (!empty($zkpProof)) {
+                        $zkpParts = explode(':', $zkpProof);
+                        if (count($zkpParts) === 3 && $zkpParts[0] === $expectedY) {
+                            if (self::verifyZkpProof($zkpParts[0], $zkpParts[1], $zkpParts[2])) {
+                                return true;
+                            }
+                        }
+                    }
+                    return false;
+                }
 
             if ($ip === $originalIp) {
                 return true;
@@ -161,7 +464,7 @@ class ChallengeUtils
             return false;
         }
 
-        $expectedSig = hash_hmac('sha256', "{$ip}:{$expiry}", self::getPowSecret());
+        $expectedSig = hash_hmac('sha256', "{$ip}:{$expiry}", !empty($secret) ? $secret : self::getPowSecret());
 
         return hash_equals($expectedSig, $sig);
     }
@@ -401,6 +704,93 @@ class ChallengeUtils
         return file_get_contents($solverPath) ?: '';
     }
 
+    public static function generateSpaceChallengePage(array $challengeDetails, string $clientSecret, array $securityConfig): string
+    {
+        $nonce = $challengeDetails['nonce'];
+        $sizeMb = $challengeDetails['sizeMb'];
+        $queries = $challengeDetails['queries'];
+        $path = $challengeDetails['path'];
+        $peerId = $challengeDetails['peerId'] ?? '';
+        $peerBlockIdx = $challengeDetails['peerBlockIdx'] ?? -1;
+        $nodeId = $nonce;
+
+        $solverCode = self::getPowSolverCode();
+        $queriesJson = json_encode($queries);
+
+        $challengeScript = <<<JS
+          async function solve() {
+            const nonce = "{$nonce}";
+            const path = "{$path}";
+            const clientSecret = "{$clientSecret}";
+            const queries = {$queriesJson};
+            const sizeMb = {$sizeMb};
+            const nodeId = "{$nodeId}";
+            const peerId = "{$peerId}";
+            const peerBlockIdx = {$peerBlockIdx};
+            
+            document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
+            await new Promise(r => setTimeout(r, 10));
+            
+            try {
+                await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
+                
+                // Enregistrement coopératif
+                await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret));
+                
+                // Écoute des requêtes entrantes de nos pairs suspects
+                setInterval(async () => {
+                    try {
+                        const res = await fetch(window.location.pathname + "?coop_op=poll_requests&node_id=" + nodeId);
+                        const data = await res.json();
+                        if (data.requests && data.requests.length > 0) {
+                            for (const req of data.requests) {
+                                document.getElementById('loader').innerText = '📤 Transfert coopératif de bloc vers le pair...';
+                                const blockData = await window.readSpaceBlock(req.block_idx);
+                                await fetch(window.location.pathname + "?coop_op=respond_block&node_id=" + nodeId + "&requester_id=" + req.requester_id + "&req_id=" + req.req_id + "&block_data=" + encodeURIComponent(blockData));
+                            }
+                        }
+                    } catch (e) {
+                        console.error("Cooperative polling error", e);
+                    }
+                }, 1000);
+                
+                // Téléchargement du bloc du pair si configuré
+                let peerBlock = "";
+                if (peerId && peerBlockIdx !== -1) {
+                    document.getElementById('loader').innerText = '📥 Téléchargement du bloc de validation du pair (' + peerId + ')...';
+                    const reqId = Math.random().toString(36).substring(2);
+                    await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId);
+                    
+                    let attempts = 0;
+                    while (attempts < 15) {
+                        const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId);
+                        const data = await res.json();
+                        if (data.status === 'ready') {
+                            peerBlock = data.block_data;
+                            break;
+                        }
+                        await new Promise(r => setTimeout(r, 1000));
+                        attempts++;
+                    }
+                    if (!peerBlock) {
+                        document.getElementById('loader').innerText = '⚠️ Peer de sous-réseau injoignable. Validation solo...';
+                    }
+                }
+                
+                document.getElementById('loader').innerText = '⚙️ Génération de la Preuve d\\'Espace...';
+                const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret, peerBlock);
+                
+                window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash + (peerBlock ? "&pow_coop=1" : "");
+            } catch(e) {
+                document.getElementById('loader').innerText = "Error initializing local storage: " + e.message;
+            }
+          }
+          solve();
+JS;
+
+        return "<html><head><title>Security Check</title></head><body style=\"font-family:sans-serif; text-align:center; padding-top:50px;\"><h1>Security Check (Level 2)</h1><p>We are verifying your storage allocation. This may take a few seconds on first load.</p><div id=\"loader\" style=\"margin:20px;\">⚙️ Initializing storage space...</div><script>{$solverCode}</script><script>{$challengeScript}</script></body></html>";
+    }
+
     /**
      * Génère le contenu HTML pour un challenge combiné CPU + Mémoire.
      * @param array $cpuChallengeDetails