@anonympins/fingerprint 0.5.5 → 0.6.1

package/src/js/problem-manager.js

@@ -341,6 +341,18 @@ class ProblemManager {
                         console.error(`[ProblemManager] Propriété 'solution' manquante dans solutionData pour ${problemId}.`);
                         return;
                     }
+            // DoS mitigation: validate solution size and structure
+            if (Array.isArray(solutionData.solution) && solutionData.solution.length > 500) {
+                console.error(`[ProblemManager] Solution array too large for ${problemId} verification.`);
+                return;
+            }
+            try {
+                const serializedSolution = JSON.stringify(solutionData.solution);
+                if (serializedSolution && serializedSolution.length > 65536) {
+                    console.error(`[ProblemManager] Solution payload size exceeds safe limit for ${problemId}.`);
+                    return;
+                }
+            } catch (e) {}
                     // 1. Ne JAMAIS faire confiance au score du client. Recalculer systématiquement.
                     const scoreFunction = problem.workUnit.scoreFunction;
                     if (!scoreFunction) {
@@ -368,6 +380,16 @@ class ProblemManager {
                         return; // Ne rien faire si la vérification est impossible.
                     }
 
+            if (solutionData.population.length > 150) {
+                console.error(`[ProblemManager] Population size exceeds safe limit for ${problemId}.`);
+                return;
+            }
+            for (const individual of solutionData.population) {
+                if (individual && individual.chromosome && Array.isArray(individual.chromosome) && individual.chromosome.length > 100) {
+                    console.error(`[ProblemManager] Chromosome size too large for ${problemId}.`);
+                    return;
+                }
+            }
                     // 1. On choisit un petit échantillon aléatoire de la population soumise.
                     const sampleSize = Math.min(5, solutionData.population.length);
                     const sampleIndices = new Set();

package/src/js/tests/cross_parity.test.js

@@ -140,21 +140,27 @@ describe('Cross-Parity Chaos PoW Floating Point Parity (JS vs WASM vs PHP)', ()
     it('should verify bit-to-bit convergence across 1,000 different seeds', () => {
         const iterations = 100;
         for (let i = 0; i < 50; i++) {
-            const seed = `seed_parity_val_${i}`;
-            const jsTrajectory = jsGenerateTrajectory(seed, iterations);
-            const phpTrajectory = runPhpTrajectory(seed, iterations);
+            const seed = `seed_parity_val_${i}`; // Use a unique seed for each iteration
+            const jsTrajectory = jsGenerateTrajectory(seed, iterations); // Generate trajectory using JS
+            const phpTrajectory = runPhpTrajectory(seed, iterations); // Generate trajectory using PHP
 
             for (let idx = 0; idx < 64; idx++) {
                 const jsVal = Math.fround(jsTrajectory[idx]);
                 const phpVal = Math.fround(phpTrajectory[idx]);
-                expect(jsVal).toBe(phpVal);
+                expect(jsVal).toBe(phpVal, `PHP and JS trajectories mismatch at index ${idx} for seed "${seed}"`);
             }
 
             if (wasmModule && typeof wasmModule._generate_gpu_pow_trajectory === 'function') {
-                const outputPtr = wasmModule._malloc(256);
-                const seedPtr = wasmModule._malloc(seed.length + 1);
-                for (let s = 0; s < seed.length; s++) {
-                    wasmModule.HEAP8[seedPtr + s] = seed.charCodeAt(s);
+                // Ensure _malloc and HEAP8 are available on the wasmModule
+                if (typeof wasmModule._malloc !== 'function' || wasmModule.HEAP8 == null) {
+                    console.warn("WASM module is missing _malloc or HEAP8. Skipping WASM parity test.");
+                    continue; // Skip WASM part of the test if prerequisites are not met
+                }
+
+                const outputPtr = wasmModule._malloc(256); // Allocate memory for 64 floats (64 * 4 bytes)
+                const seedPtr = wasmModule._malloc(seed.length + 1); // Allocate memory for seed string + null terminator
+                for (let s = 0; s < seed.length; s++) { // Copy seed string to WASM memory
+                    wasmModule.HEAP8[seedPtr + s] = seed.charCodeAt(s); // HEAP8 is Int8Array
                 }
                 wasmModule.HEAP8[seedPtr + seed.length] = 0;
 
@@ -163,13 +169,13 @@ describe('Cross-Parity Chaos PoW Floating Point Parity (JS vs WASM vs PHP)', ()
                 const wasmOutput = new Float32Array(wasmModule.HEAPF32.buffer, outputPtr, 64);
                 for (let idx = 0; idx < 64; idx++) {
                     const jsVal = Math.fround(jsTrajectory[idx]);
-                    const wasmVal = Math.fround(wasmOutput[idx]);
-                    expect(jsVal).toBe(wasmVal);
+                    const wasmVal = Math.fround(wasmOutput[idx]); // Ensure float32 precision for comparison
+                    expect(jsVal).toBe(wasmVal, `WASM and JS trajectories mismatch at index ${idx} for seed "${seed}"`);
                 }
 
                 wasmModule._free(outputPtr);
                 wasmModule._free(seedPtr);
             }
         }
-    }, 20000);
+    }, 30000); // Increased timeout for potentially longer WASM compilation/execution
 });

package/src/js/tests/fingerprint.client.test.js

@@ -1,129 +1,131 @@
-/**
- * @vitest-environment jsdom
- */
-
-import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
-import ClientLibrary from '../fingerprint.client.js';
-
-describe('ClientLibrary WASM Integration', () => {
-    beforeEach(() => {
-        // Réinitialise le cache et les mocks avant chaque test
-        ClientLibrary._resetCache();
-        vi.spyOn(console, 'log').mockImplementation(() => {});
-        vi.spyOn(console, 'warn').mockImplementation(() => {});
-
-        // Supprime les mocks globaux pour éviter les fuites entre les tests
-        delete window.createFingerprintModule;
-    });
-
-    afterEach(() => {
-        vi.restoreAllMocks();
-    });
-
-    it('should successfully load WASM module and switch hasher', async () => {
-        // 1. Simuler un module WASM fonctionnel
-        const mockWasmModule = {
-            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
-        };
-
-        // 2. Simuler le chargement du script et l'initialisation du module
-        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        // On simule l'injection du script en appelant directement `onload`
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            // Simule le chargement réussi du script
-            script.onload();
-            return script;
-        });
-
-        // 3. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 4. Vérifier que le hasher a été remplacé
-        const wasmHash = ClientLibrary._hasher("test");
-        expect(wasmHash).toBe(99999);
-        expect(mockWasmModule._hash_string).toHaveBeenCalledWith("test");
-        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-    });
-
-    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
-        // 1. Simuler un échec de chargement du script
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onerror(new Error('Script loading failed'));
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier que le hasher est toujours l'implémentation JS
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        
-        expect(jsHash).toBe(originalJsHash);
-        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
-    });
-
-    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
-        // 1. Simuler un module WASM malformé (sans la fonction attendue)
-        const mockWasmModule = {};
-        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
-
-        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            script.onload();
-            return script;
-        });
-
-        // 2. Appeler la fonction d'initialisation
-        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
-
-        // 3. Vérifier le fallback
-        const jsHash = ClientLibrary._hasher("test");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
-        expect(jsHash).toBe(originalJsHash); 
-        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
-        expect(console.warn).toHaveBeenCalledWith(
-            expect.stringContaining('WASM module failed to load'), 
-            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
-        );
-    });
-
-    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
-        const mockWasmInstance = {
-            exports: {
-                memory: { buffer: new ArrayBuffer(65536) },
-                hash: vi.fn().mockReturnValue(123456)
-            }
-        };
-        
-        global.WebAssembly = {
-            compile: vi.fn().mockResolvedValue({}),
-            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
-        };
-        
-        global.fetch = vi.fn().mockResolvedValue({
-            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
-        });
-
-        await ClientLibrary.initializeWasm('/fp.wasm');
-
-        const hash = ClientLibrary._hasher("test");
-        expect(hash).toBe(123456);
-        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
-    });
-
-    it('should use the default JS hasher if WASM is not configured', async () => {
-        // Ensure no WASM path is provided in the config
-        ClientLibrary.initializeClient({});
-
-        // Verify that the active hasher is the original JS implementation
-        const jsHash = ClientLibrary._hasher("another test string");
-        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
-
-        expect(jsHash).toBe(originalJsHash);
-        // Ensure no WASM-related console logs or warnings were made
-        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
-        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
-    });
+/**
+ * @vitest-environment jsdom
+ */
+
+import {afterEach, beforeEach, describe, expect, it, vi} from 'vitest';
+import ClientLibrary from '../fingerprint.client.js';
+
+describe('ClientLibrary WASM Integration', () => {
+    beforeEach(() => {
+        // Réinitialise le cache et les mocks avant chaque test
+        ClientLibrary._resetCache();
+        vi.spyOn(console, 'log').mockImplementation(() => {});
+        vi.spyOn(console, 'warn').mockImplementation(() => {});
+
+        // Supprime les mocks globaux pour éviter les fuites entre les tests
+        delete window.createFingerprintModule;
+    });
+
+    afterEach(() => {
+        vi.restoreAllMocks();
+    });
+
+    it('should successfully load WASM module and switch hasher', async () => {
+        // 1. Simuler un module WASM fonctionnel
+        const mockWasmModule = {
+            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
+            _malloc: vi.fn().mockReturnValue(0),
+            HEAPU8: new Uint8Array(4096)
+        };
+
+        // 2. Simuler le chargement du script et l'initialisation du module
+        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        // On simule l'injection du script en appelant directement `onload`
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            // Simule le chargement réussi du script
+            script.onload();
+            return script;
+        });
+
+        // 3. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 4. Vérifier que le hasher a été remplacé
+        const wasmHash = ClientLibrary._hasher("test");
+        expect(wasmHash).toBe(99999);
+        expect(mockWasmModule._hash_string).toHaveBeenCalledWith(0);
+        expect(console.log).toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+    });
+
+    it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
+        // 1. Simuler un échec de chargement du script
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onerror(new Error('Script loading failed'));
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier que le hasher est toujours l'implémentation JS
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        
+        expect(jsHash).toBe(originalJsHash);
+        expect(console.warn).toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'), expect.any(Error));
+    });
+
+    it('should gracefully fall back if WASM module does not export _hash_string', async () => {
+        // 1. Simuler un module WASM malformé (sans la fonction attendue)
+        const mockWasmModule = {};
+        window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
+
+        vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
+            script.onload();
+            return script;
+        });
+
+        // 2. Appeler la fonction d'initialisation
+        await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
+
+        // 3. Vérifier le fallback
+        const jsHash = ClientLibrary._hasher("test");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
+        expect(jsHash).toBe(originalJsHash); 
+        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
+        expect(console.warn).toHaveBeenCalledWith(
+            expect.stringContaining('WASM module failed to load'), 
+            expect.objectContaining({ message: 'WASM module did not export _hash_string.' })
+        );
+    });
+
+    it('should successfully load raw WASM and use standalone polymorphic hasher', async () => {
+        const mockWasmInstance = {
+            exports: {
+                memory: { buffer: new ArrayBuffer(65536) },
+                hash: vi.fn().mockReturnValue(123456)
+            }
+        };
+        
+        global.WebAssembly = {
+            compile: vi.fn().mockResolvedValue({}),
+            instantiate: vi.fn().mockResolvedValue(mockWasmInstance)
+        };
+        
+        global.fetch = vi.fn().mockResolvedValue({
+            arrayBuffer: vi.fn().mockResolvedValue(new ArrayBuffer(100))
+        });
+
+        await ClientLibrary.initializeWasm('/fp.wasm');
+
+        const hash = ClientLibrary._hasher("test");
+        expect(hash).toBe(123456);
+        expect(mockWasmInstance.exports.hash).toHaveBeenCalledWith(0, 4);
+    });
+
+    it('should use the default JS hasher if WASM is not configured', async () => {
+        // Ensure no WASM path is provided in the config
+        ClientLibrary.initializeClient({});
+
+        // Verify that the active hasher is the original JS implementation
+        const jsHash = ClientLibrary._hasher("another test string");
+        const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("another test string");
+
+        expect(jsHash).toBe(originalJsHash);
+        // Ensure no WASM-related console logs or warnings were made
+        expect(console.log).not.toHaveBeenCalledWith(expect.stringContaining('WASM module loaded successfully'));
+        expect(console.warn).not.toHaveBeenCalledWith(expect.stringContaining('WASM module failed to load'));
+    });
 });

package/src/js/tests/fingerprint.test.js

@@ -2643,6 +2643,11 @@ describe('Ed25519 Asymmetric Tickets', () => {
         const nodeIdA = 'node-a';
         const seedA = 'seed-a';
 
+        // Configurer les secrets dans le store pour passer la validation de signature
+        const store = __internal.store;
+        await store.set('secret:node-a', { clientSecret: 'secret-a' });
+        await store.set('secret:node-b', { clientSecret: 'secret-b' });
+
         // 1. Enregistrement du nœud A (pair)
         await __internal.registerCooperativeNode(clientIp, nodeIdA, seedA);
 
@@ -2652,21 +2657,31 @@ describe('Ed25519 Asymmetric Tickets', () => {
         expect(peer.nodeId).toBe(nodeIdA);
         expect(peer.seed).toBe(seedA);
 
+        const sigReq = createHash('sha256')
+            .update('secret-b:request_peer_block:node-b:node-a:42:req-123')
+            .digest('hex');
+
         // 3. Demande de bloc du nœud B vers le nœud A
         const paramsReq = {
             coop_op: 'request_peer_block',
             node_id: 'node-b',
             peer_id: 'node-a',
             block_idx: '42',
-            req_id: 'req-123'
+            req_id: 'req-123',
+            coop_sig: sigReq
         };
         const resReq = await __internal.handleCooperativeRequest(paramsReq, clientIp);
         expect(resReq.status).toBe('queued');
 
+        const sigPoll = createHash('sha256')
+            .update('secret-a:poll_requests:node-a')
+            .digest('hex');
+
         // 4. Récupération de la demande par le nœud A
         const paramsPoll = {
             coop_op: 'poll_requests',
-            node_id: 'node-a'
+            node_id: 'node-a',
+            coop_sig: sigPoll
         };
         const resPoll = await __internal.handleCooperativeRequest(paramsPoll, clientIp);
         expect(resPoll.requests.length).toBe(1);

package/src/js/ttl-optimization.worker.js

@@ -0,0 +1,51 @@
+import { parentPort } from "node:worker_threads";
+import { Optimization } from "./library.js";
+
+const MIN_TTL = 300000;
+const MAX_TTL = 86400000;
+const keyScores = [0, 10, 20, 30, 40, 50, 60, 70, 80, 90, 100];
+const tempCache = {};
+
+for (const suspicionScore of keyScores) {
+    const solverFunction = () => {
+        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
+        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
+        const mutate = (ttl) => {
+            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1;
+            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
+        };
+
+        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
+            createIndividual,
+            fitnessFunction,
+            crossover,
+            mutate,
+            {
+                generations: 40,
+                populationSize: 30,
+            }
+        );
+
+        if (!paretoFront || paretoFront.length === 0) {
+            return { solution: null, fitness: Infinity };
+        }
+
+        let bestSolutionInFront;
+        if (suspicionScore < 50) {
+            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+        } else {
+            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+        }
+        return { solution: bestSolutionInFront, fitness: 0 };
+    };
+
+    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+    if (bestResult && bestResult.solution && bestResult.solution !== Infinity) {
+        tempCache[suspicionScore] = Math.round(bestResult.solution);
+    } else {
+        tempCache[suspicionScore] = Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
+    }
+}
+
+parentPort.postMessage(tempCache);

package/src/php/Challenge/ChallengeUtils.php

@@ -138,7 +138,7 @@ class ChallengeUtils
         return $activePeers[array_rand($activePeers)];
     }
 
-    public static function handleCooperativeRequest(array $params): ?array
+    public static function handleCooperativeRequest(array $params, string $clientIp = '127.0.0.1', array $config = []): ?array
     {
         $op = $params['coop_op'] ?? null;
         if (!$op) {
@@ -146,11 +146,108 @@ class ChallengeUtils
         }
 
         $store = StoreManager::getStore();
+
+
+        if ($op === 'share_threat_intel') {
+            $peers = $config['federatedPeers'] ?? [];
+            if (!empty($peers)) {
+                $allowedHosts = array_map(function ($url) {
+                    $host = parse_url($url, PHP_URL_HOST);
+                    return !empty($host) ? $host : $url;
+                }, $peers);
+
+                if (!in_array($clientIp, $allowedHosts, true)) {
+                    return ['error' => 'Unauthorized federation sender IP'];
+                }
+            }
+            $zkpY = $params['zkpY'] ?? '';
+            $headers = function_exists('getallheaders') ? array_change_key_case(getallheaders(), CASE_LOWER) : [];
+            $sigEd25519 = $params['signature_ed25519'] ?? $headers['x-federation-signature-ed25519'] ?? $_SERVER['HTTP_X_FEDERATION_SIGNATURE_ED25519'] ?? '';
+            $sigHmac = $params['signature'] ?? $headers['x-federation-signature'] ?? $_SERVER['HTTP_X_FEDERATION_SIGNATURE'] ?? '';
+            $timestamp = (int)($params['timestamp'] ?? $headers['x-federation-timestamp'] ?? $_SERVER['HTTP_X_FEDERATION_TIMESTAMP'] ?? 0);
+
+            if (empty($zkpY) || empty($timestamp)) {
+                return ['error' => 'Missing threat intel parameters'];
+            }
+
+            // Time window check (5 minutes anti-replay)
+            $now = (int)(microtime(true) * 1000);
+            if (abs($now - $timestamp) > 300000) {
+                return ['error' => 'Message expired or clock skew too high'];
+            }
+
+            $msg = "{$timestamp}:{$zkpY}";
+
+            if (!empty($sigEd25519)) {
+                $publicKey = $config['ed25519_public_key'] ?? $_ENV['ED25519_PUBLIC_KEY'] ?? getenv('ED25519_PUBLIC_KEY');
+                if (!$publicKey) {
+                    return ['error' => 'Missing public key for asymmetric verification'];
+                }
+                try {
+                    $cleanKey = str_replace('\n', "\n", $publicKey);
+                    $pubKeyObj = openssl_pkey_get_public($cleanKey);
+                    if (!$pubKeyObj || openssl_verify($msg, hex2bin($sigEd25519), $pubKeyObj, null) !== 1) {
+                        return ['error' => 'Invalid asymmetric federation signature'];
+                    }
+                } catch (\Throwable $e) {
+                    return ['error' => 'Asymmetric signature verification failed'];
+                }
+            } elseif (!empty($sigHmac)) {
+                $secret = $params['federationSecret'] ?? $config['federationSecret'] ?? self::getPowSecret();
+                $expectedSig = hash_hmac('sha256', $msg, $secret);
+                if (!hash_equals($expectedSig, $sigHmac)) {
+                    return ['error' => 'Invalid federation signature'];
+                }
+            } else {
+                return ['error' => 'Missing signature'];
+            }
+
+            // Ban the ZKP public key for 30 days
+            $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
+            return ['status' => 'synchronized'];
+        }
+
         $nodeId = $params['node_id'] ?? '';
         if (empty($nodeId)) {
             return ['error' => 'Missing node_id'];
         }
 
+        // --- VÉRIFICATION DE LA SIGNATURE COOPÉRATIVE ---
+        $challengeContext = $store->get("secret:{$nodeId}");
+        if (!$challengeContext || empty($challengeContext['clientSecret'])) {
+            return ['error' => 'Invalid or expired node_id'];
+        }
+
+        $clientSecret = $challengeContext['clientSecret'];
+        $coopSig = $params['coop_sig'] ?? '';
+
+        $expectedMsg = '';
+        switch ($op) {
+            case 'register':
+                $expectedMsg = "{$clientSecret}:register:{$nodeId}:" . ($params['seed'] ?? '');
+                break;
+            case 'request_peer_block':
+                $expectedMsg = "{$clientSecret}:request_peer_block:{$nodeId}:" . ($params['peer_id'] ?? '') . ":" . ($params['block_idx'] ?? '0') . ":" . ($params['req_id'] ?? '');
+                break;
+            case 'poll_requests':
+                $expectedMsg = "{$clientSecret}:poll_requests:{$nodeId}";
+                break;
+            case 'respond_block':
+                $expectedMsg = "{$clientSecret}:respond_block:{$nodeId}:" . ($params['requester_id'] ?? '') . ":" . ($params['req_id'] ?? '') . ":" . ($params['block_data'] ?? '');
+                break;
+            case 'poll_response':
+                $expectedMsg = "{$clientSecret}:poll_response:{$nodeId}:" . ($params['req_id'] ?? '');
+                break;
+            default:
+                return ['error' => 'Invalid cooperative operation'];
+        }
+
+        $expectedSig = hash('sha256', $expectedMsg);
+        if (!hash_equals($expectedSig, $coopSig)) {
+            return ['error' => 'Invalid cooperative signature'];
+        }
+        // --- FIN DE LA VÉRIFICATION ---
+
         switch ($op) {
             case 'register':
                 $clientIp = $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1';
@@ -298,7 +395,7 @@ class ChallengeUtils
     /**
      * Récupère la clé secrète pour les PoW depuis les variables d'environnement.
      */
-    private static function getPowSecret(): string
+    public static function getPowSecret(): string
     {
         $secret = $_ENV['POW_SECRET'] ?? getenv('POW_SECRET');
         if (!$secret && ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production') {
@@ -857,25 +954,38 @@ class ChallengeUtils
             const peerBlockIdx = {$peerBlockIdx};
             const coopTimeout = {$coopTimeout};
             
+            async function signCoop(op, nid, extra = "") {
+              const msg = clientSecret + ":" + op + ":" + nid + (extra ? ":" + extra : "");
+              const encoder = new TextEncoder();
+              const data = encoder.encode(msg);
+              const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+              return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('');
+            }
+            
             document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
             await new Promise(r => setTimeout(r, 10));
             
             try {
                 await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
                 
-                // Enregistrement coopératif
-                await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret));
+                if (peerId && peerBlockIdx !== -1) {
+                    // Enregistrement coopératif
+                    const sig = await signCoop("register", nodeId, nonce + ":" + clientSecret);
+                    await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret) + "&coop_sig=" + sig);
+                }
                 
                 // Écoute des requêtes entrantes de nos pairs suspects
                 setInterval(async () => {
                     try {
-                        const res = await fetch(window.location.pathname + "?coop_op=poll_requests&node_id=" + nodeId);
+                        const sig = await signCoop("poll_requests", nodeId);
+                        const res = await fetch(window.location.pathname + "?coop_op=poll_requests&node_id=" + nodeId + "&coop_sig=" + sig);
                         const data = await res.json();
                         if (data.requests && data.requests.length > 0) {
                             for (const req of data.requests) {
                                 document.getElementById('loader').innerText = '📤 Transfert coopératif de bloc vers le pair...';
                                 const blockData = await window.readSpaceBlock(req.block_idx);
-                                await fetch(window.location.pathname + "?coop_op=respond_block&node_id=" + nodeId + "&requester_id=" + req.requester_id + "&req_id=" + req.req_id + "&block_data=" + encodeURIComponent(blockData));
+                                const respSig = await signCoop("respond_block", nodeId, req.requester_id + ":" + req.req_id + ":" + blockData);
+                                await fetch(window.location.pathname + "?coop_op=respond_block&node_id=" + nodeId + "&requester_id=" + req.requester_id + "&req_id=" + req.req_id + "&block_data=" + encodeURIComponent(blockData) + "&coop_sig=" + respSig);
                             }
                         }
                     } catch (e) {
@@ -888,11 +998,13 @@ class ChallengeUtils
                 if (peerId && peerBlockIdx !== -1) {
                     document.getElementById('loader').innerText = '📥 Téléchargement du bloc de validation du pair (' + peerId + ')...';
                     const reqId = Math.random().toString(36).substring(2);
-                    await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId);
+                    const reqSig = await signCoop("request_peer_block", nodeId, peerId + ":" + peerBlockIdx + ":" + reqId);
+                    await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId + "&coop_sig=" + reqSig);
                     
                     let attempts = 0;
                     while (attempts < coopTimeout) {
-                        const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId);
+                        const pollSig = await signCoop("poll_response", nodeId, reqId);
+                        const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId + "&coop_sig=" + pollSig);
                         const data = await res.json();
                         if (data.status === 'ready') {
                             peerBlock = data.block_data;