@anonympins/fingerprint 0.4.6 → 0.5.1

package/src/php/Challenge/ChallengeUtils.php

@@ -14,6 +14,48 @@ use Anonympins\Fingerprint\Utils\RequestUtils;
  */
 class ChallengeUtils
 {
+    private static function fround(float $value): float
+    {
+        return unpack('f', pack('f', $value))[1];
+    }
+
+    public static function hashSeedToFloat(string $seed): float
+    {
+        $hash = 0;
+        for ($i = 0; $i < strlen($seed); $i++) {
+            $hash = (($hash << 5) - $hash + ord($seed[$i])) & 0xffffffff;
+            if ($hash & 0x80000000) {
+                $hash = $hash - 0x100000000;
+            }
+        }
+        return abs($hash % 1000000) / 1000000;
+    }
+
+    public static function verifyGpuPow(string $seed, int $iterations, string $solution, array $sampleIndices = [0, 12, 35, 57]): bool
+    {
+        $values = explode(',', $solution);
+        if (count($values) !== 64) {
+            return false;
+        }
+        $numericSeed = self::hashSeedToFloat($seed);
+        $r = 3.9999;
+        foreach ($sampleIndices as $idx) {
+            if ($idx < 0 || $idx >= 64) {
+                return false;
+            }
+            $x = self::fround($numericSeed + $idx * 0.015);
+            $rFloat = self::fround($r);
+            for ($i = 0; $i < $iterations; $i++) {
+                $x = self::fround($rFloat * $x * self::fround(1.0 - $x));
+            }
+            $clientVal = (float)$values[$idx];
+            if (abs($clientVal - $x) > 1e-4) {
+                return false;
+            }
+        }
+        return true;
+    }
+
     private const TRAP_URL_TEMPLATES = [
         '/includes/config-{RANDOM}.php',
         '/.env.{RANDOM}',
@@ -48,6 +90,123 @@ class ChallengeUtils
         return $block;
     }
 
+    public static function registerCooperativeNode(string $clientIp, string $nodeId, string $seed): void
+    {
+        $subnet = RequestUtils::getIpSubnet($clientIp);
+        if ($subnet === null) {
+            return;
+        }
+        $store = StoreManager::getStore();
+        $key = "coop-pospace:subnet:{$subnet}";
+        $nodes = $store->get($key) ?? [];
+        
+        $now = time();
+        // Nettoyage des nœuds expirés (vieux de plus de 2 minutes)
+        $nodes = array_filter($nodes, fn($n) => ($now - $n['timestamp']) < 120);
+        
+        $nodes[$nodeId] = [
+            'nodeId' => $nodeId,
+            'seed' => $seed,
+            'timestamp' => $now
+        ];
+        
+        $store->set($key, $nodes, 120);
+    }
+
+    public static function findPeerInSubnet(string $clientIp, string $excludeNodeId): ?array
+    {
+        $subnet = RequestUtils::getIpSubnet($clientIp);
+        if ($subnet === null) {
+            return null;
+        }
+        $store = StoreManager::getStore();
+        $key = "coop-pospace:subnet:{$subnet}";
+        $nodes = $store->get($key) ?? [];
+        
+        $now = time();
+        $activePeers = [];
+        foreach ($nodes as $id => $node) {
+            if ($id !== $excludeNodeId && ($now - $node['timestamp']) < 120) {
+                $activePeers[] = $node;
+            }
+        }
+        
+        if (empty($activePeers)) {
+            return null;
+        }
+        
+        return $activePeers[array_rand($activePeers)];
+    }
+
+    public static function handleCooperativeRequest(array $params): ?array
+    {
+        $op = $params['coop_op'] ?? null;
+        if (!$op) {
+            return null;
+        }
+
+        $store = StoreManager::getStore();
+        $nodeId = $params['node_id'] ?? '';
+        if (empty($nodeId)) {
+            return ['error' => 'Missing node_id'];
+        }
+
+        switch ($op) {
+            case 'register':
+                $clientIp = $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1';
+                $seed = $params['seed'] ?? '';
+                self::registerCooperativeNode($clientIp, $nodeId, $seed);
+                return ['status' => 'registered'];
+
+            case 'request_peer_block':
+                $peerId = $params['peer_id'] ?? '';
+                $blockIdx = (int)($params['block_idx'] ?? 0);
+                $requestId = $params['req_id'] ?? '';
+                if (empty($peerId) || empty($requestId)) {
+                    return ['error' => 'Invalid parameters'];
+                }
+                
+                $queueKey = "coop-mailbox:queue:{$peerId}";
+                $requests = $store->get($queueKey) ?? [];
+                $requests[] = [
+                    'req_id' => $requestId,
+                    'requester_id' => $nodeId,
+                    'block_idx' => $blockIdx
+                ];
+                $store->set($queueKey, $requests, 30);
+                return ['status' => 'queued'];
+
+            case 'poll_requests':
+                $queueKey = "coop-mailbox:queue:{$nodeId}";
+                $requests = $store->get($queueKey) ?? [];
+                $store->delete($queueKey);
+                return ['requests' => $requests];
+
+            case 'respond_block':
+                $requesterId = $params['requester_id'] ?? '';
+                $requestId = $params['req_id'] ?? '';
+                $blockData = $params['block_data'] ?? '';
+                if (empty($requesterId) || empty($requestId)) {
+                    return ['error' => 'Invalid parameters'];
+                }
+                
+                $responseKey = "coop-mailbox:res:{$requesterId}:{$requestId}";
+                $store->set($responseKey, ['block_data' => $blockData], 30);
+                return ['status' => 'delivered'];
+
+            case 'poll_response':
+                $requestId = $params['req_id'] ?? '';
+                $responseKey = "coop-mailbox:res:{$nodeId}:{$requestId}";
+                $data = $store->get($responseKey);
+                if ($data) {
+                    $store->delete($responseKey);
+                    return ['status' => 'ready', 'block_data' => $data['block_data']];
+                }
+                return ['status' => 'pending'];
+        }
+        return null;
+    }
+
     public static function generateSpaceChallenge(string $clientIp, string $nonce, float $suspicionFactor, string $originalUrl, array $securityConfig): array
     {
         $pospaceConfig = $securityConfig['pospace'] ?? [];
@@ -63,13 +222,29 @@ class ChallengeUtils
             }
         }
 
-        return [
+        $challenge = [
             'type' => 'pospace',
             'nonce' => $nonce,
             'sizeMb' => $sizeMb,
             'queries' => $queries,
             'path' => $originalUrl
         ];
+
+        // Tentative de couplage coopératif avec un nœud du même sous-réseau
+        $peer = self::findPeerInSubnet($clientIp, $nonce);
+        if ($peer !== null) {
+            $challenge['peerId'] = $peer['nodeId'];
+            $challenge['peerBlockIdx'] = random_int(0, $maxBlocks - 1);
+            
+            $store = StoreManager::getStore();
+            $store->set("coop-assoc:{$nonce}", [
+                'peerNodeId' => $peer['nodeId'],
+                'peerSeed' => $peer['seed'],
+                'peerBlockIdx' => $challenge['peerBlockIdx']
+            ], 120);
+        }
+
+        return $challenge;
     }
 
     public static function verifySpacePoW(string $nonce, string $solution, array $queries, string $seed, string $clientSecret): bool
@@ -78,11 +253,48 @@ class ChallengeUtils
         foreach ($queries as $idx) {
             $combined .= self::generateBlock($seed, (int)$idx);
         }
+        
+        // Vérification de la preuve coopérative
+        $store = StoreManager::getStore();
+        $assoc = $store->get("coop-assoc:{$nonce}");
+        if ($assoc !== null) {
+            $peerSeed = $assoc['peerSeed'] ?? null;
+            $peerBlockIdx = $assoc['peerBlockIdx'] ?? null;
+            if ($peerSeed !== null && $peerBlockIdx !== null) {
+                $combined .= self::generateBlock($peerSeed, (int)$peerBlockIdx);
+            }
+            $store->delete("coop-assoc:{$nonce}");
+        }
+
         $finalBlock = $combined . $nonce . ":" . $clientSecret;
         $hash = hash('sha256', $finalBlock);
         return hash_equals($hash, $solution);
     }
 
+    public static function verifyZkpProof(string $yStr, string $tStr, string $sStr): bool
+    {
+        try {
+            $p = BigInt::fromHex('fffffffffffffffffffffffffffffffffffffffffffffffffffffffefffffc2f'); // secp256k1 prime
+            $g = new BigInt(2);
+
+            $y = BigInt::fromHex($yStr);
+            $t = BigInt::fromHex($tStr);
+            $s = BigInt::fromHex($sStr);
+
+            $cStr = (string)$g . (string)$y . (string)$t;
+            $cHex = hash('sha256', $cStr);
+            $c = BigInt::fromHex($cHex)->mod($p);
+
+            $left = $g->modPow($s, $p);
+            $y_c = $y->modPow($c, $p);
+            $right = $t->mul($y_c)->mod($p);
+
+            return $left->compareTo($right) === 0;
+        } catch (\Throwable $e) {
+            return false;
+        }
+    }
+
     /**
      * Récupère la clé secrète pour les PoW depuis les variables d'environnement.
      */
@@ -102,6 +314,22 @@ class ChallengeUtils
      */
     public static function generateStatelessTicket(array $payload): string
     {
+        $ed25519Key = $_ENV['ED25519_PRIVATE_KEY'] ?? getenv('ED25519_PRIVATE_KEY');
+        if ($ed25519Key) {
+            try {
+                $serialized = json_encode($payload);
+                $privateKey = openssl_pkey_get_private($ed25519Key);
+                if ($privateKey && openssl_sign($serialized, $signature, $privateKey, null)) {
+                    $base64UrlEncode = function ($input) {
+                        return rtrim(strtr(base64_encode($input), '+/', '-_'), '=');
+                    };
+                    return 'ed25519.' . $base64UrlEncode($serialized) . '.' . $base64UrlEncode($signature);
+                }
+            } catch (\Throwable $e) {
+                error_log("[ChallengeUtils] Ed25519 signing failed: " . $e->getMessage());
+            }
+        }
+
         $key = hash('sha256', self::getPowSecret(), true);
         $iv = random_bytes(16);
         $encrypted = openssl_encrypt(json_encode($payload), 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
@@ -115,10 +343,40 @@ class ChallengeUtils
     /**
      * Décode et valide un ticket stateless chiffré et signé.
      * @param string $ticket
+     * @param string $secret
      * @return array|null
      */
-    public static function parseStatelessTicket(string $ticket): ?array
+    public static function parseStatelessTicket(string $ticket, string $secret = ''): ?array
     {
+        try {
+            if (str_starts_with($ticket, 'ed25519.')) {
+                $parts = explode('.', $ticket);
+                if (count($parts) !== 3) {
+                    return null;
+                }
+                $base64UrlDecode = function ($input) {
+                    return base64_decode(strtr($input, '-_', '+/'));
+                };
+                $payloadJson = $base64UrlDecode($parts[1]);
+                $signature = $base64UrlDecode($parts[2]);
+                
+                $ed25519PubKey = $_ENV['ED25519_PUBLIC_KEY'] ?? getenv('ED25519_PUBLIC_KEY');
+                if (!$ed25519PubKey) {
+                    error_log("[ChallengeUtils] ED25519_PUBLIC_KEY is not defined in environment.");
+                    return null;
+                }
+                
+                $publicKey = openssl_pkey_get_public($ed25519PubKey);
+                if ($publicKey && openssl_verify($payloadJson, $signature, $publicKey, null) === 1) {
+                    return json_decode($payloadJson, true);
+                }
+                return null;
+            }
+        } catch (\Throwable $e) {
+            error_log("[ChallengeUtils] Ed25519 verification failed: " . $e->getMessage());
+            return null;
+        }
+
         $parts = explode('.', $ticket);
         if (count($parts) !== 3) {
             return null;
@@ -132,7 +390,7 @@ class ChallengeUtils
         if (!$iv || !$encrypted || !$signature || strlen($iv) !== 16) {
             return null;
         }
-        $key = hash('sha256', self::getPowSecret(), true);
+        $key = hash('sha256', !empty($secret) ? $secret : self::getPowSecret(), true);
         $expectedSignature = hash_hmac('sha256', $iv . $encrypted, $key, true);
         if (!hash_equals($expectedSignature, $signature)) {
             return null;
@@ -143,20 +401,23 @@ class ChallengeUtils
 
     /**
      * Vérifie si un ticket de passage est valide (supporte les tickets opaques via store et le fallback legacy).
+     * Supporte une clé secrète optionnelle passée en paramètre pour la compatibilité avec les tests.
      */
     public static function isTicketValid(
         ?string $ip,
         ?string $ticket,
         string $deviceId = '',
         string $deviceHash = '',
-        bool $allowCrossNetworkRoaming = false
+        bool $allowCrossNetworkRoaming = false,
+        string $secret = '',
+        string $zkpProof = ''
     ): bool {
         if (empty($ip) || empty($ticket)) {
             return false;
         }
 
         // Tentative de validation stateless d'abord
-        $ticketData = self::parseStatelessTicket($ticket);
+        $ticketData = self::parseStatelessTicket($ticket, $secret);
         if ($ticketData !== null) {
             $expiry = $ticketData['expiry'] ?? null;
             $originalIp = $ticketData['originalIp'] ?? null;
@@ -166,6 +427,18 @@ class ChallengeUtils
             if (!$expiry || (int)floor(microtime(true) * 1000) > (int)$expiry) {
                 return false;
             }
+                if ($storedDeviceHash && str_starts_with($storedDeviceHash, 'zkp:')) {
+                    $expectedY = explode(':', $storedDeviceHash, 2)[1] ?? '';
+                    if (!empty($zkpProof)) {
+                        $zkpParts = explode(':', $zkpProof);
+                        if (count($zkpParts) === 3 && $zkpParts[0] === $expectedY) {
+                            if (self::verifyZkpProof($zkpParts[0], $zkpParts[1], $zkpParts[2])) {
+                                return true;
+                            }
+                        }
+                    }
+                    return false;
+                }
             if ($ip === $originalIp) {
                 return true;
             }
@@ -193,6 +466,18 @@ class ChallengeUtils
                 $store->delete("ticket:{$ticket}");
                 return false;
             }
+                if ($storedDeviceHash && str_starts_with($storedDeviceHash, 'zkp:')) {
+                    $expectedY = explode(':', $storedDeviceHash, 2)[1] ?? '';
+                    if (!empty($zkpProof)) {
+                        $zkpParts = explode(':', $zkpProof);
+                        if (count($zkpParts) === 3 && $zkpParts[0] === $expectedY) {
+                            if (self::verifyZkpProof($zkpParts[0], $zkpParts[1], $zkpParts[2])) {
+                                return true;
+                            }
+                        }
+                    }
+                    return false;
+                }
 
             if ($ip === $originalIp) {
                 return true;
@@ -221,7 +506,7 @@ class ChallengeUtils
             return false;
         }
 
-        $expectedSig = hash_hmac('sha256', "{$ip}:{$expiry}", self::getPowSecret());
+        $expectedSig = hash_hmac('sha256', "{$ip}:{$expiry}", !empty($secret) ? $secret : self::getPowSecret());
 
         return hash_equals($expectedSig, $sig);
     }
@@ -467,6 +752,9 @@ class ChallengeUtils
         $sizeMb = $challengeDetails['sizeMb'];
         $queries = $challengeDetails['queries'];
         $path = $challengeDetails['path'];
+        $peerId = $challengeDetails['peerId'] ?? '';
+        $peerBlockIdx = $challengeDetails['peerBlockIdx'] ?? -1;
+        $nodeId = $nonce;
 
         $solverCode = self::getPowSolverCode();
         $queriesJson = json_encode($queries);
@@ -478,16 +766,63 @@ class ChallengeUtils
             const clientSecret = "{$clientSecret}";
             const queries = {$queriesJson};
             const sizeMb = {$sizeMb};
+            const nodeId = "{$nodeId}";
+            const peerId = "{$peerId}";
+            const peerBlockIdx = {$peerBlockIdx};
             
             document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
             await new Promise(r => setTimeout(r, 10));
             
             try {
                 await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
-                document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
-                const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
                 
-                window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash;
+                // Enregistrement coopératif
+                await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret));
+                
+                // Écoute des requêtes entrantes de nos pairs suspects
+                setInterval(async () => {
+                    try {
+                        const res = await fetch(window.location.pathname + "?coop_op=poll_requests&node_id=" + nodeId);
+                        const data = await res.json();
+                        if (data.requests && data.requests.length > 0) {
+                            for (const req of data.requests) {
+                                document.getElementById('loader').innerText = '📤 Transfert coopératif de bloc vers le pair...';
+                                const blockData = await window.readSpaceBlock(req.block_idx);
+                                await fetch(window.location.pathname + "?coop_op=respond_block&node_id=" + nodeId + "&requester_id=" + req.requester_id + "&req_id=" + req.req_id + "&block_data=" + encodeURIComponent(blockData));
+                            }
+                        }
+                    } catch (e) {
+                        console.error("Cooperative polling error", e);
+                    }
+                }, 1000);
+                
+                // Téléchargement du bloc du pair si configuré
+                let peerBlock = "";
+                if (peerId && peerBlockIdx !== -1) {
+                    document.getElementById('loader').innerText = '📥 Téléchargement du bloc de validation du pair (' + peerId + ')...';
+                    const reqId = Math.random().toString(36).substring(2);
+                    await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId);
+                    
+                    let attempts = 0;
+                    while (attempts < 15) {
+                        const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId);
+                        const data = await res.json();
+                        if (data.status === 'ready') {
+                            peerBlock = data.block_data;
+                            break;
+                        }
+                        await new Promise(r => setTimeout(r, 1000));
+                        attempts++;
+                    }
+                    if (!peerBlock) {
+                        document.getElementById('loader').innerText = '⚠️ Peer de sous-réseau injoignable. Validation solo...';
+                    }
+                }
+                
+                document.getElementById('loader').innerText = '⚙️ Génération de la Preuve d\\'Espace...';
+                const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret, peerBlock);
+                
+                window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash + (peerBlock ? "&pow_coop=1" : "");
             } catch(e) {
                 document.getElementById('loader').innerText = "Error initializing local storage: " + e.message;
             }

package/src/php/Config/SecurityProfiles.php

@@ -41,6 +41,8 @@ class SecurityProfiles
                 'subnetScore' => 0.5, // Pénalise les sous-réseaux IP avec une activité suspecte agrégée
                 'botnetClusterScore' => 0.6, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 0.8, // NEW: Anomalie QUIC
+                'renderingAnomalyScore' => 0.8, // NEW: Anomalie de rendu
 
             ],
             'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95],
@@ -87,6 +89,8 @@ class SecurityProfiles
                 'subnetScore' => 0.7, // Poids plus élevé en mode strict
                 'botnetClusterScore' => 0.8, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 1.0, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 1.0, // NEW: Anomalie QUIC
+                'renderingAnomalyScore' => 1.0, // NEW: Anomalie de rendu
 
             ],
             'thresholds' => ['low' => 10, 'medium' => 35, 'high' => 65, 'block' => 90],
@@ -133,6 +137,7 @@ class SecurityProfiles
                 'subnetScore' => 0.8, // Très important pour les API pour détecter les botnets
                 'botnetClusterScore' => 0.7, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 0.8, // NEW: Anomalie QUIC
 
             ],
             'thresholds' => ['low' => 25, 'medium' => 50, 'high' => 80, 'block' => 95],
@@ -181,6 +186,8 @@ class SecurityProfiles
                 'subnetScore' => 0.4, // Utile contre le spam de commentaires coordonné
                 'botnetClusterScore' => 0.5, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.5, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 0.5, // NEW: Anomalie QUIC
+                'renderingAnomalyScore' => 0.5, // NEW: Anomalie de rendu
 
             ],
             'thresholds' => ['low' => 25, 'medium' => 55, 'high' => 80, 'block' => 95],
@@ -228,6 +235,8 @@ class SecurityProfiles
                 'subnetScore' => 0.9, // Crucial contre les attaques de scalping distribuées
                 'botnetClusterScore' => 0.9, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.9, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 0.9, // NEW: Anomalie QUIC
+                'renderingAnomalyScore' => 0.9, // NEW: Anomalie de rendu
 
             ],
             'thresholds' => ['low' => 15, 'medium' => 40, 'high' => 70, 'block' => 90],

package/src/php/FingerprintEngine.php

@@ -30,6 +30,29 @@
      public function __construct(array $securityConfig)
      {
          $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
+         
+         // Dynamically bind Ed25519 keys if passed via config
+         if (isset($securityConfig['ed25519_private_key'])) {
+             $_ENV['ED25519_PRIVATE_KEY'] = $securityConfig['ed25519_private_key'];
+         }
+         if (isset($securityConfig['ed25519_public_key'])) {
+             $_ENV['ED25519_PUBLIC_KEY'] = $securityConfig['ed25519_public_key'];
+         }
+
+         // Auto-load optimized config if autotuning savePath is specified
+         if (isset($securityConfig['autotuning']['savePath'])) {
+             $savePath = $securityConfig['autotuning']['savePath'];
+             if (file_exists($savePath)) {
+                 try {
+                     $savedConfig = json_decode(file_get_contents($savePath), true);
+                     if (json_last_error() === JSON_ERROR_NONE && is_array($savedConfig)) {
+                         $securityConfig = SecurityProfiles::deepMerge($securityConfig, $savedConfig);
+                     }
+                 } catch (\Throwable $e) {
+                     error_log("[FingerprintEngine] Failed to auto-load optimized config from {$savePath}: " . $e->getMessage());
+                 }
+             }
+         }
          $this->securityConfig = $securityConfig;
          $this->verbose = $securityConfig['verbose'] ?? false;
          $this->allowlist = $this->buildAllowlist();
@@ -38,6 +61,19 @@
          $this->validateConfig($securityConfig);
      }
 
+    /**
+     * Applique à chaud une nouvelle configuration de sécurité (poids, seuils, etc.)
+     * sans nécessiter de redémarrage.
+     *
+     * @param array $newConfig La nouvelle configuration (partielle ou complète).
+     */
+    public function updateConfig(array $newConfig): void
+    {
+        $this->validateConfig($newConfig);
+        $this->securityConfig = SecurityProfiles::deepMerge($this->securityConfig, $newConfig);
+        $this->log('Configuration mise à jour à chaud (Hot-Reloaded)', $this->securityConfig);
+    }
+
      private function validateConfig(array $config): void
      {
          if (empty($config)) {
@@ -50,7 +86,8 @@
              'deviceIdCookieMaxAge', 'challengePagePath', 'verbose', 'patterns',
              'honeypot', 'threatIntel', 'whitelist', 'isStaticResource', 'isApiRequest', 'logger', 'probationaryTtl',
              'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
-             'similarityThreshold', 'summary', 'description'
+             'similarityThreshold', 'summary', 'description',
+             'ed25519_private_key', 'ed25519_public_key'
          ];
 
          if (empty($config['weights'])) {
@@ -443,6 +480,12 @@
          // Score d'anomalie de pile TCP/IP
          $tcpAnomaly = RequestUtils::getTcpAnomalyScore($context);
 
+         // Score d'anomalie de flux QUIC/HTTP3
+         $quicAnomaly = RequestUtils::getQuicAnomalyScore($context);
+
+         // Score d'anomalie de rendu d'affichage (V-Sync)
+         $renderingAnomaly = RequestUtils::getRenderingAnomalyScore($context);
+
          // Assemblage du vecteur de suspicion final
          $suspicionVector = array_merge($suspicionVector, [
              'inconsistencyScore' => $inconsistencyScore,
@@ -462,6 +505,8 @@
              'subnetScore' => $subnetScore['subnetScore'],
              'botnetClusterScore' => $botnetCluster['botnetClusterScore'],
              'tcpAnomalyScore' => $tcpAnomaly['tcpAnomalyScore'],
+             'quicAnomalyScore' => $quicAnomaly['quicAnomalyScore'],
+             'renderingAnomalyScore' => $renderingAnomaly['renderingAnomalyScore'],
          ]);
  
          // Sauvegarder l'état mis à jour de l'appareil dans le store
@@ -589,6 +634,16 @@
          // Initialiser le vecteur de suspicion pour éviter les erreurs de type.
          $suspicionVector = [];
         
+         $coopOp = $context->query['coop_op'] ?? null;
+         if ($coopOp) {
+             $result = ChallengeUtils::handleCooperativeRequest($context->query);
+             return [
+                 'action' => 'challenge',
+                 'status' => 200,
+                 'body' => $result
+             ];
+         }
+
         $this->log('Processing request', ['clientIp' => $context->clientIp, 'path' => $context->path]);
         
         // Parse GraphQL query if applicable
@@ -737,7 +792,11 @@
          // 3. Vérifier un ticket existant
          $hasValidTicket = false;
          $powCookie = $context->cookies['pow_clearance'] ?? null;
-         if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie)) {
+         $zkpProof = $context->getHeader('x-zkp-proof') ?? $context->query['pow_zkp'] ?? '';
+         $deviceId = $context->cookies['device_id'] ?? '';
+         $currentDeviceHash = RequestUtils::getCompositeDeviceHash($context);
+         $allowRoaming = $this->securityConfig['allowCrossNetworkRoaming'] ?? false;
+         if (ChallengeUtils::isTicketValid($context->clientIp, $powCookie, $deviceId, $currentDeviceHash, $allowRoaming, $zkpProof)) {
              $hasValidTicket = true;
             MetricsManager::incrementCounter('tickets_valid_total');
              // On ne retourne pas tout de suite pour permettre le re-challenge

package/src/php/RequestContext.php

@@ -38,6 +38,7 @@ class RequestContext
     public ?string $ja4s = null;
     public ?string $ja4h = null;
     public ?string $http2Fingerprint = null;
+    public ?string $quicFingerprint = null;
     public ?string $tcpFingerprint = null;
 
     /**
@@ -77,6 +78,7 @@ class RequestContext
         $this->ja4h = $this->headers['x-ja4h-hash'] ?? null;
         $this->http2Fingerprint = $this->headers['x-http2-fingerprint'] ?? null;
         $this->tcpFingerprint = $this->headers['x-tcp-fingerprint'] ?? null;
+        $this->quicFingerprint = $this->headers['x-quic-fp'] ?? null;
         $this->tlsSessionId = $this->headers['x-tls-session-id'] ?? $this->headers['x-ssl-session-id'] ?? null;
     }
     /**