@anonympins/fingerprint 0.5.0 → 0.5.2

package/src/php/Challenge/ChallengeUtils.php

@@ -14,6 +14,48 @@ use Anonympins\Fingerprint\Utils\RequestUtils;
  */
 class ChallengeUtils
 {
+    private static function fround(float $value): float
+    {
+        return unpack('f', pack('f', $value))[1];
+    }
+
+    public static function hashSeedToFloat(string $seed): float
+    {
+        $hash = 0;
+        for ($i = 0; $i < strlen($seed); $i++) {
+            $hash = (($hash << 5) - $hash + ord($seed[$i])) & 0xffffffff;
+            if ($hash & 0x80000000) {
+                $hash = $hash - 0x100000000;
+            }
+        }
+        return abs($hash % 1000000) / 1000000;
+    }
+
+    public static function verifyGpuPow(string $seed, int $iterations, string $solution, array $sampleIndices = [0, 12, 35, 57]): bool
+    {
+        $values = explode(',', $solution);
+        if (count($values) !== 64) {
+            return false;
+        }
+        $numericSeed = self::hashSeedToFloat($seed);
+        $r = 3.9999;
+        foreach ($sampleIndices as $idx) {
+            if ($idx < 0 || $idx >= 64) {
+                return false;
+            }
+            $x = self::fround($numericSeed + $idx * 0.015);
+            $rFloat = self::fround($r);
+            for ($i = 0; $i < $iterations; $i++) {
+                $x = self::fround($rFloat * $x * self::fround(1.0 - $x));
+            }
+            $clientVal = (float)$values[$idx];
+            if (abs($clientVal - $x) > 1e-4) {
+                return false;
+            }
+        }
+        return true;
+    }
+
     private const TRAP_URL_TEMPLATES = [
         '/includes/config-{RANDOM}.php',
         '/.env.{RANDOM}',
@@ -596,6 +638,55 @@ class ChallengeUtils
     /**
      * Vérifie une solution de PoW mémoire.
      */
+    private static function getChallengedIndices(string $seed, int $solution, int $numBlocks, int $k = 4): array
+    {
+        $indices = [];
+        $h = (int)bcmod(\Anonympins\Fingerprint\FingerprintBuilder::cyrb53($seed . ":" . $solution), '4294967296');
+        for ($i = 0; $i < $k; $i++) {
+            $h = self::gmp_imul($h ^ $i, 1597334677);
+            $indices[] = abs($h) % $numBlocks;
+        }
+        return $indices;
+    }
+
+    private static function verifyMerkleProof(string $leafHash, int $index, array $proof, string $root): bool
+    {
+        $currentHash = $leafHash;
+        $idx = $index;
+        foreach ($proof as $sibling) {
+            $combined = ($idx % 2 === 0) ? $currentHash . $sibling : $sibling . $currentHash;
+            $currentHash = hash('sha256', hex2bin($combined));
+            $idx = (int)floor($idx / 2);
+        }
+        return $currentHash === $root;
+    }
+
+    private static function verifyMemoryPoWLegacy(string $nonce, int $solution, int $difficulty, string $clientSecret): bool
+    {
+        $size = $difficulty * 1024 * 1024;
+        $iterations = (int)floor($size / 16);
+        $buffer = new \SplFixedArray((int)floor($size / 4));
+
+        $seed = ":{$nonce}:{$clientSecret}";
+        $h = 0;
+        foreach (unpack('C*', $seed) as $byte) {
+            $h += $byte;
+        }
+
+        for ($i = 0; $i < count($buffer); $i++) {
+            $buffer[$i] = $h = self::gmp_imul($h ^ $i, 1597334677);
+        }
+
+        $finalHash = 0;
+        $addr = count($buffer) > 0 ? $buffer[0] % count($buffer) : 0;
+        for ($i = 0; $i < $iterations; $i++) {
+            $addr = $buffer[$addr] % count($buffer);
+            $finalHash ^= $addr;
+        }
+
+        return $finalHash === $solution;
+    }
+
     public static function verifyMemoryPoW(
         string $nonce,
         string $solution,
@@ -612,37 +703,69 @@ class ChallengeUtils
             return false;
         }
 
-        // If difficulty is high (production workloads), we treat memory PoW purely as a client-side cost.
-        // Cryptographic integrity is already fully enforced by the chained CPU PoW verification.
-        if ($difficulty > 4) {
-            return true;
+        $data = json_decode($solution, true);
+        if (json_last_error() !== JSON_ERROR_NONE || !isset($data['solution']) || !isset($data['merkleRoot']) || !isset($data['proofs'])) {
+            if ($difficulty <= 4 && preg_match('/^\d+$/', $solution)) {
+                return self::verifyMemoryPoWLegacy($nonce, (int)$solution, $difficulty, $clientSecret);
+            }
+            return false;
         }
 
-        $size = $difficulty * 1024 * 1024;
-        if ($size <= 0) {
-            return true; // Pas de challenge mémoire si la difficulté est nulle ou négative.
-        }
-        $iterations = (int)floor($size / 16);
-        $buffer = new \SplFixedArray((int)floor($size / 4));
+        $sol = $data['solution'];
+        $merkleRoot = $data['merkleRoot'];
+        $proofs = $data['proofs'];
 
+        $numBlocks = $difficulty * 256;
         $seed = ":{$nonce}:{$clientSecret}";
-        $h = 0;
-        foreach (unpack('C*', $seed) as $byte) {
-            $h += $byte;
-        }
 
-        for ($i = 0; $i < count($buffer); $i++) {
-            $buffer[$i] = $h = self::gmp_imul($h ^ $i, 1597334677);
+        $challengedIndices = self::getChallengedIndices($seed, (int)$sol, $numBlocks, 4);
+
+        foreach ($challengedIndices as $b) {
+            $proof = $proofs[$b] ?? $proofs[(string)$b] ?? null;
+            if ($proof === null) return false;
+
+            $blockBytes = '';
+            $h = (int)bcmod(\Anonympins\Fingerprint\FingerprintBuilder::cyrb53($seed . ":" . $b), '4294967296');
+            for ($i = 0; $i < 1024; $i++) {
+                $h = self::gmp_imul($h ^ $i, 1597334677);
+                $blockBytes .= pack('V', $h);
+            }
+
+            $expectedLeaf = hash('sha256', $blockBytes);
+
+            if (!self::verifyMerkleProof($expectedLeaf, $b, $proof, $merkleRoot)) {
+                return false;
+            }
         }
 
-        $finalHash = 0;
-        $addr = count($buffer) > 0 ? $buffer[0] % count($buffer) : 0;
+        $blockCache = [];
+        $getBlockElement = function (int $blockIdx, int $elementIdx) use (&$blockCache, $seed): int {
+            if (!isset($blockCache[$blockIdx])) {
+                $block = [];
+                $h = (int)bcmod(\Anonympins\Fingerprint\FingerprintBuilder::cyrb53($seed . ":" . $blockIdx), '4294967296');
+                for ($i = 0; $i < 1024; $i++) {
+                    $h = self::gmp_imul($h ^ $i, 1597334677);
+                    $block[$i] = $h;
+                }
+                $blockCache[$blockIdx] = $block;
+            }
+            return $blockCache[$blockIdx][$elementIdx];
+        };
+
+        $totalElements = $numBlocks * 1024;
+        $addr = $totalElements > 0 ? $getBlockElement(0, 0) % $totalElements : 0;
+        $addr = $addr & 0xffffffff;
+        $expectedSolution = 0;
+        $iterations = 1024;
         for ($i = 0; $i < $iterations; $i++) {
-            $addr = $buffer[$addr] % count($buffer);
-            $finalHash ^= $addr;
+            $blockIdx = (int)floor($addr / 1024);
+            $elementIdx = $addr % 1024;
+            $addr = $getBlockElement($blockIdx, $elementIdx) % $totalElements;
+            $addr = $addr & 0xffffffff;
+            $expectedSolution ^= $addr;
         }
 
-        return $finalHash === (int)$solution;
+        return $expectedSolution === (int)$sol;
     }
 
     /**
@@ -717,11 +840,15 @@ class ChallengeUtils
         $solverCode = self::getPowSolverCode();
         $queriesJson = json_encode($queries);
 
+        $safePath = json_encode($path, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+        $safeNonce = json_encode($nonce, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+        $safeClientSecret = json_encode($clientSecret, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+
         $challengeScript = <<<JS
           async function solve() {
-            const nonce = "{$nonce}";
-            const path = "{$path}";
-            const clientSecret = "{$clientSecret}";
+            const nonce = {$safeNonce};
+            const path = {$safePath};
+            const clientSecret = {$safeClientSecret};
             const queries = {$queriesJson};
             const sizeMb = {$sizeMb};
             const nodeId = "{$nodeId}";
@@ -824,11 +951,15 @@ JS;
         ));
         $trapContainerHtml = "<div style=\"position:absolute;left:-9999px;top:-9999px;transform:scale(0);pointer-events:none;\" aria-hidden=\"true\">{$trapLinksHtml}</div>";
 
+        $safePath = json_encode($path, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+        $safeNonce = json_encode($nonce, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+        $safeClientSecret = json_encode($clientSecret, JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT | JSON_UNESCAPED_SLASHES);
+
         $challengeScript = <<<JS
           async function solve() {
-            const nonce = "{$nonce}";
-            const path = "{$path}";
-            const clientSecret = "{$clientSecret}";
+            const nonce = {$safeNonce};
+            const path = {$safePath};
+            const clientSecret = {$safeClientSecret};
             const cpuTarget = BigInt("0x" + "{$target}");
             const memDifficulty = {$memoryDifficulty};
             const baseBlock = new Uint8Array({$baseBlockBytes});

package/src/php/Config/SecurityProfiles.php

@@ -41,6 +41,8 @@ class SecurityProfiles
                 'subnetScore' => 0.5, // Pénalise les sous-réseaux IP avec une activité suspecte agrégée
                 'botnetClusterScore' => 0.6, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 0.8, // NEW: Anomalie QUIC
+                'renderingAnomalyScore' => 0.8, // NEW: Anomalie de rendu
 
             ],
             'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95],
@@ -87,6 +89,8 @@ class SecurityProfiles
                 'subnetScore' => 0.7, // Poids plus élevé en mode strict
                 'botnetClusterScore' => 0.8, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 1.0, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 1.0, // NEW: Anomalie QUIC
+                'renderingAnomalyScore' => 1.0, // NEW: Anomalie de rendu
 
             ],
             'thresholds' => ['low' => 10, 'medium' => 35, 'high' => 65, 'block' => 90],
@@ -133,6 +137,7 @@ class SecurityProfiles
                 'subnetScore' => 0.8, // Très important pour les API pour détecter les botnets
                 'botnetClusterScore' => 0.7, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 0.8, // NEW: Anomalie QUIC
 
             ],
             'thresholds' => ['low' => 25, 'medium' => 50, 'high' => 80, 'block' => 95],
@@ -181,6 +186,8 @@ class SecurityProfiles
                 'subnetScore' => 0.4, // Utile contre le spam de commentaires coordonné
                 'botnetClusterScore' => 0.5, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.5, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 0.5, // NEW: Anomalie QUIC
+                'renderingAnomalyScore' => 0.5, // NEW: Anomalie de rendu
 
             ],
             'thresholds' => ['low' => 25, 'medium' => 55, 'high' => 80, 'block' => 95],
@@ -228,6 +235,8 @@ class SecurityProfiles
                 'subnetScore' => 0.9, // Crucial contre les attaques de scalping distribuées
                 'botnetClusterScore' => 0.9, // NOUVEAU: Poids pour le clustering botnet
                 'tcpAnomalyScore' => 0.9, // NEW: Anomalie de pile TCP/IP
+                'quicAnomalyScore' => 0.9, // NEW: Anomalie QUIC
+                'renderingAnomalyScore' => 0.9, // NEW: Anomalie de rendu
 
             ],
             'thresholds' => ['low' => 15, 'medium' => 40, 'high' => 70, 'block' => 90],

package/src/php/FingerprintEngine.php

@@ -27,6 +27,10 @@
      private ?Logger $logger = null;
      private bool $dryRun;
 
+     private static ?array $googlebotEntries = null;
+     private static ?array $yandexEntries = null;
+     private static ?array $bingbotEntries = null;
+
      public function __construct(array $securityConfig)
      {
          $this->isProduction = ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production';
@@ -61,6 +65,19 @@
          $this->validateConfig($securityConfig);
      }
 
+    /**
+     * Applique à chaud une nouvelle configuration de sécurité (poids, seuils, etc.)
+     * sans nécessiter de redémarrage.
+     *
+     * @param array $newConfig La nouvelle configuration (partielle ou complète).
+     */
+    public function updateConfig(array $newConfig): void
+    {
+        $this->validateConfig($newConfig);
+        $this->securityConfig = SecurityProfiles::deepMerge($this->securityConfig, $newConfig);
+        $this->log('Configuration mise à jour à chaud (Hot-Reloaded)', $this->securityConfig);
+    }
+
      private function validateConfig(array $config): void
      {
          if (empty($config)) {
@@ -90,7 +107,103 @@
              }
          }
      }
+     private static function loadBotWhitelist(string $filename, array $fallbackEntries): array
+     {
+         $configDir = dirname(__DIR__, 2) . '/config';
+         $filePath = $configDir . '/' . $filename;
+         if (file_exists($filePath)) {
+             try {
+                 $content = file_get_contents($filePath);
+                 if ($content !== false) {
+                     $decoded = json_decode($content, true);
+                     if (json_last_error() === JSON_ERROR_NONE && is_array($decoded)) {
+                         return $decoded;
+                     }
+                 }
+             } catch (\Throwable $e) {
+                 error_log("[Fingerprint] Error loading whitelist file {$filename}: " . $e->getMessage());
+             }
+         }
+         return $fallbackEntries;
+     }
+
+     public static function googlebot_whitelist(): array
+     {
+         if (self::$googlebotEntries === null) {
+             self::$googlebotEntries = self::loadBotWhitelist('googlebot.json', [
+                 "2001:4860:4801:10::/64",
+                 "2001:4860:4801:11::/64",
+                 "2001:4860:4801:12::/64",
+                 "66.249.79.64"
+             ]);
+         }
+         return [
+             'type' => 'allowlist',
+             'entries' => self::$googlebotEntries
+         ];
+     }
 
+     public static function yandex_whitelist(): array
+     {
+         if (self::$yandexEntries === null) {
+             self::$yandexEntries = self::loadBotWhitelist('yandex.json', [
+                 "2a02:6b8::/29",
+                 "5.45.192.0/18",
+                 "213.180.192.0/19"
+             ]);
+         }
+         return [
+             'type' => 'allowlist',
+             'entries' => self::$yandexEntries
+         ];
+     }
+
+     public static function bingbot_whitelist(): array
+     {
+         if (self::$bingbotEntries === null) {
+             self::$bingbotEntries = self::loadBotWhitelist('bingbot.json', [
+                 "157.55.39.0/24",
+                 "207.46.13.0/24",
+                 "40.77.178.0/23"
+             ]);
+         }
+         return [
+             'type' => 'allowlist',
+             'entries' => self::$bingbotEntries
+         ];
+     }
+
+     public static function default_whitelist(): array
+     {
+         return [
+             self::googlebot_whitelist(),
+             self::bingbot_whitelist(),
+             self::yandex_whitelist(),
+             ['userAgent' => 'Googlebot', 'hostnameSuffix' => '.googlebot.com'],
+             ['userAgent' => 'Google-Extended', 'hostnameSuffix' => '.google.com'],
+             ['userAgent' => 'AdsBot-Google', 'hostnameSuffix' => '.googlebot.com'],
+             ['userAgent' => 'Mediapartners-Google', 'hostnameSuffix' => '.google.com'],
+             ['userAgent' => 'Google-InspectionTool', 'hostnameSuffix' => '.google.com'],
+             ['userAgent' => '(bingbot|adidxbot)', 'hostnameSuffix' => '.search.msn.com'],
+             ['userAgent' => 'DuckDuckBot', 'hostnameSuffix' => '.duckduckgo.com'],
+             ['userAgent' => 'YandexBot', 'hostnameSuffix' => '.yandex.com'],
+             ['userAgent' => 'YandexImages', 'hostnameSuffix' => '.yandex.com'],
+             ['userAgent' => 'Baiduspider', 'hostnameSuffix' => '.crawl.baidu.com'],
+             ['userAgent' => 'Slurp', 'hostnameSuffix' => '.crawl.yahoo.net'],
+             ['userAgent' => 'Sogou web spider', 'hostnameSuffix' => '.sogou.com'],
+             ['userAgent' => 'Exabot', 'hostnameSuffix' => '.exabot.com'],
+             ['userAgent' => 'ia_archiver', 'hostnameSuffix' => '.alexa.com'],
+             ['userAgent' => 'SeznamBot', 'hostnameSuffix' => '.seznam.cz'],
+             ['userAgent' => 'Mail.RU_Bot', 'hostnameSuffix' => '.mail.ru'],
+             ['userAgent' => 'Yeti', 'hostnameSuffix' => '.naver.com'],
+             ['userAgent' => 'AhrefsBot', 'hostnameSuffix' => '.ahrefs.com'],
+             ['userAgent' => 'SemrushBot', 'hostnameSuffix' => '.semrush.com'],
+             ['userAgent' => 'MJ12bot', 'hostnameSuffix' => '.mj12bot.com'],
+             ['userAgent' => 'rogerbot', 'hostnameSuffix' => '.moz.com'],
+             ['userAgent' => 'DotBot', 'hostnameSuffix' => '.moz.com'],
+             ['userAgent' => 'Screaming Frog SEO Spider', 'hostnameSuffix' => '.screamingfrog.co.uk'],
+         ];
+     }
      private function log(string $message, array $data = [], string $level = 'info'): void
      {
          if ($this->verbose) {
@@ -467,6 +580,12 @@
          // Score d'anomalie de pile TCP/IP
          $tcpAnomaly = RequestUtils::getTcpAnomalyScore($context);
 
+         // Score d'anomalie de flux QUIC/HTTP3
+         $quicAnomaly = RequestUtils::getQuicAnomalyScore($context);
+
+         // Score d'anomalie de rendu d'affichage (V-Sync)
+         $renderingAnomaly = RequestUtils::getRenderingAnomalyScore($context);
+
          // Assemblage du vecteur de suspicion final
          $suspicionVector = array_merge($suspicionVector, [
              'inconsistencyScore' => $inconsistencyScore,
@@ -486,6 +605,8 @@
              'subnetScore' => $subnetScore['subnetScore'],
              'botnetClusterScore' => $botnetCluster['botnetClusterScore'],
              'tcpAnomalyScore' => $tcpAnomaly['tcpAnomalyScore'],
+             'quicAnomalyScore' => $quicAnomaly['quicAnomalyScore'],
+             'renderingAnomalyScore' => $renderingAnomaly['renderingAnomalyScore'],
          ]);
  
          // Sauvegarder l'état mis à jour de l'appareil dans le store
@@ -1018,8 +1139,9 @@
                      'target' => ChallengeUtils::calculateCpuTarget($suspicionFactor, $this->securityConfig),
                      'path' => $context->path,
                  ];
- 
-                 $memActivationFactor = max(0, ($suspicionFactor - 0.25) / 0.75);
+
+                 // Alignement linéaire parfait du ratio d'effort CPU/Mémoire
+                 $memActivationFactor = $suspicionFactor;
                  $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
  
                  $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);

package/src/php/RequestContext.php

@@ -38,6 +38,7 @@ class RequestContext
     public ?string $ja4s = null;
     public ?string $ja4h = null;
     public ?string $http2Fingerprint = null;
+    public ?string $quicFingerprint = null;
     public ?string $tcpFingerprint = null;
 
     /**
@@ -77,6 +78,7 @@ class RequestContext
         $this->ja4h = $this->headers['x-ja4h-hash'] ?? null;
         $this->http2Fingerprint = $this->headers['x-http2-fingerprint'] ?? null;
         $this->tcpFingerprint = $this->headers['x-tcp-fingerprint'] ?? null;
+        $this->quicFingerprint = $this->headers['x-quic-fp'] ?? null;
         $this->tlsSessionId = $this->headers['x-tls-session-id'] ?? $this->headers['x-ssl-session-id'] ?? null;
     }
     /**

package/src/php/Tests/ChallengeUtilsTest.php

@@ -10,6 +10,83 @@ use PHPUnit\Framework\TestCase;
 
 class ChallengeUtilsTest extends TestCase
 {
+    public function testGpuPowDeterministicHashing(): void
+    {
+        $seed = 'test-seed-determinism';
+        $f1 = ChallengeUtils::hashSeedToFloat($seed);
+        $f2 = ChallengeUtils::hashSeedToFloat($seed);
+        $f3 = ChallengeUtils::hashSeedToFloat('different-seed');
+
+        $this->assertEquals($f1, $f2, 'Seed hashing must be deterministic.');
+        $this->assertGreaterThanOrEqual(0, $f1);
+        $this->assertLessThan(1, $f1);
+        $this->assertNotEquals($f1, $f3);
+    }
+
+    public function testGpuPowVerificationRejectsTamperedSolution(): void
+    {
+        $seed = 'php-verification-seed';
+        $iterations = 100;
+
+        // Generate correct solutions mimicking the GPU solver trajectory
+        $numericSeed = ChallengeUtils::hashSeedToFloat($seed);
+        $r = 3.9999;
+        $solutions = [];
+        $fround = function (float $value): float {
+            return unpack('f', pack('f', $value))[1];
+        };
+
+        for ($idx = 0; $idx < 64; $idx++) {
+            $x = $fround($numericSeed + $idx * 0.015);
+            $rFloat = $fround($r);
+            for ($i = 0; $i < $iterations; $i++) {
+                $x = $fround($rFloat * $x * $fround(1.0 - $x));
+            }
+            $solutions[] = number_format($x, 6, '.', '');
+        }
+        $validSolution = implode(',', $solutions);
+
+        $this->assertTrue(ChallengeUtils::verifyGpuPow($seed, $iterations, $validSolution));
+
+        // Tamper with value on verified sample index 12
+        $tampered = $solutions;
+        $tampered[12] = (string)((float)$tampered[12] + 0.0002); // Out of tolerance
+        $this->assertFalse(ChallengeUtils::verifyGpuPow($seed, $iterations, implode(',', $tampered)));
+    }
+
+    public function testGpuPowVerification(): void
+    {
+        $seed = 'php-gpu-test-seed';
+        $iterations = 50;
+        
+        $hash = 0;
+        for ($i = 0; $i < strlen($seed); $i++) {
+            $hash = (($hash << 5) - $hash + ord($seed[$i])) & 0xffffffff;
+            if ($hash & 0x80000000) {
+                $hash = $hash - 0x100000000;
+            }
+        }
+        $numericSeed = abs($hash % 1000000) / 1000000;
+        $r = 3.9999;
+        $solutions = [];
+        $fround = function (float $value): float {
+            return unpack('f', pack('f', $value))[1];
+        };
+        for ($idx = 0; $idx < 64; $idx++) {
+            $x = $fround($numericSeed + $idx * 0.015);
+            $rFloat = $fround($r);
+            for ($i = 0; $i < $iterations; $i++) {
+                $x = $fround($rFloat * $x * $fround(1.0 - $x));
+            }
+            $solutions[] = number_format($x, 6, '.', '');
+        }
+        $solutionString = implode(',', $solutions);
+        $this->assertTrue(ChallengeUtils::verifyGpuPow($seed, $iterations, $solutionString));
+        $tamperedSolutions = $solutions;
+        $tamperedSolutions[0] = (string)((float)$tamperedSolutions[0] + 0.1);
+        $this->assertFalse(ChallengeUtils::verifyGpuPow($seed, $iterations, implode(',', $tamperedSolutions)));
+    }
+
     protected function setUp(): void
     {
         // Définir une clé secrète pour les tests

package/src/php/Tests/QuicFingerprintTest.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class QuicFingerprintTest extends TestCase
+{
+    public function testGetQuicAnomalyScoreReturnsZeroIfNoFp(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturn(null);
+        $res = RequestUtils::getQuicAnomalyScore($context);
+        $this->assertEquals(0.0, $res['quicAnomalyScore']);
+    }
+
+    public function testGetQuicAnomalyScoreDetectsSpoofedChrome(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            }
+            if ($name === 'x-quic-fp') {
+                return '1;1=65536,4=50;i=0';
+            }
+            return null;
+        });
+
+        $res = RequestUtils::getQuicAnomalyScore($context);
+        $this->assertEquals(100.0, $res['quicAnomalyScore']);
+    }
+
+    public function testGetQuicAnomalyScoreAllowsLegitChrome(): void
+    {
+        $context = $this->createMock(RequestContext::class);
+        $context->method('getHeader')->willReturnCallback(function($name) {
+            if ($name === 'user-agent') {
+                return 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36';
+            }
+            if ($name === 'x-quic-fp') {
+                return '1;1=1572864,4=100;u=2,i';
+            }
+            return null;
+        });
+
+        $res = RequestUtils::getQuicAnomalyScore($context);
+        $this->assertEquals(0.0, $res['quicAnomalyScore']);
+    }
+}

package/src/php/Tests/RequestUtilsTest.php

@@ -48,6 +48,28 @@ class RequestUtilsTest extends TestCase
         $score = RequestUtils::getCrossLayerInconsistency($context);
         $this->assertEquals(20.0, $score['crossLayerInconsistencyScore']);
     }
+    public function testGetRenderingAnomalyScoreEmpty(): void
+    {
+        $context = $this->createRequestContext();
+        $res = RequestUtils::getRenderingAnomalyScore($context);
+        $this->assertEquals(0.0, $res['renderingAnomalyScore']);
+    }
+
+    public function testGetRenderingAnomalyScoreSpoofed(): void
+    {
+        $metrics = [
+            'rendering' => [
+                'fps' => 60,
+                'jitter' => 12.5,
+                'offscreenAnom' => false
+            ]
+        ];
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
+        ]);
+        $res = RequestUtils::getRenderingAnomalyScore($context);
+        $this->assertEquals(65.0, $res['renderingAnomalyScore']);
+    }
     public function testGetClickVarianceScoreReturnsZeroForNoHistory(): void
     {
         $context = $this->createRequestContext([
@@ -185,6 +207,27 @@ class RequestUtilsTest extends TestCase
         $this->assertEquals(40.0, $scoreNoActivity['behaviorScore']);
     }
 
+    public function testGetBehaviorScoreWithBotLikeKeystrokeDynamics(): void
+    {
+        $metrics = [
+            'honeypotInteraction' => false,
+            'keystrokeLatency' => 100.0,
+            'keystrokeDwellTimes' => [50, 50, 50, 50, 50],
+            'keystrokeFlightTimes' => [
+                ['digraph' => 'ab', 'time' => 100],
+                ['digraph' => 'bc', 'time' => 100],
+                ['digraph' => 'cd', 'time' => 100],
+                ['digraph' => 'de', 'time' => 100],
+                ['digraph' => 'ef', 'time' => 100]
+            ]
+        ];
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
+        ]);
+        $score = RequestUtils::getBehaviorScore($context);
+        $this->assertGreaterThanOrEqual(70.0, $score['behaviorScore']);
+    }
+
     public function testGetBehaviorScoreWithBotLikeTouchMovements(): void
     {
         $metrics = [