@anonympins/fingerprint 0.5.5 → 0.6.1

package/src/php/FingerprintBuilder.php

@@ -1,186 +1,194 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint;
-
-/**
- * Classe pour construire une empreinte composite (Multi-Hash).
- * Format de sortie : "grp1:hash1|grp2:hash2|grp3:hash3"
- */
-class FingerprintBuilder
-{
-    /**
-     * @var array<string, string|int>
-     */
-    private array $components = [];
-
-    /**
-     * Ajoute un composant à l'empreinte.
-     * La valeur est hachée pour l'anonymiser et réduire sa taille.
-     *
-     * @param string $group Le nom du groupe (ex: 'hw', 'screen', 'geo').
-     * @param string|int|bool|null $value La valeur brute à hacher.
-     * @return self
-     */
-    public function add(string $group, $value): self
-    {
-        if ($value === null || $value === '') {
-            return $this;
-        }
-        // On hache la valeur individuellement.
-        $this->components[$group] = self::cyrb53((string)$value);
-        return $this;
-    }
-
-    /**
-     * Ajoute un composant brut sans le hacher.
-     * Utile pour les métriques qui doivent être lues telles quelles par le serveur.
-     *
-     * @param string $group Le nom du groupe.
-     * @param string|int|null $value La valeur brute.
-     * @return self
-     */
-    public function addRaw(string $group, $value): self
-    {
-        if ($value === null) {
-            return $this;
-        }
-        $this->components[$group] = $value;
-        return $this;
-    }
-
-    /**
-     * Génère la chaîne de l'empreinte finale.
-     * Les composants sont triés par clé pour garantir un ordre déterministe.
-     *
-     * @return string
-     */
-    public function __toString(): string
-    {
-        // ksort trie le tableau par clé.
-        ksort($this->components);
-
-        $parts = [];
-        foreach ($this->components as $key => $hash) {
-            $parts[] = "{$key}:{$hash}";
-        }
-
-        return implode('|', $parts);
-    }
-
-    /**
-     * Compare deux empreintes et retourne un score de similarité (de 0 à 1).
-     * Utilise une pondération pour donner plus d'importance aux invariants forts (Canvas, GPU, JA3).
-     *
-     * @param string|null $fpString1 Empreinte A.
-     * @param string|null $fpString2 Empreinte B.
-     * @return float
-     */
-    public static function compare(?string $fpString1, ?string $fpString2): float
-    {
-        if (empty($fpString1) || empty($fpString2)) {
-            return 0.0;
-        }
-
-        $parse = function (string $str): array {
-            $map = [];
-            foreach (explode('|', $str) as $part) {
-                $pair = explode(':', $part, 2);
-                if (count($pair) === 2 && !empty($pair[0]) && !empty($pair[1])) {
-                    $map[$pair[0]] = $pair[1];
-                }
-            }
-            return $map;
-        };
-
-        $map1 = $parse($fpString1);
-        $map2 = $parse($fpString2);
-
-        $volatileKeys = [
-            'ch_ua', 'ch_platform', 'ch_mobile', 'ch_model', 'ch_arch', 'ch_bitness',
-            'cookie_keys', 'upgrade', 'network', 'http_ver',
-            'x_forwarded_for', 'x_real_ip', 'cf_connecting_ip'
-        ];
-
-        $weights = [
-            'cvs' => 5.0, 'gpu' => 4.0, 'ja3' => 3.5, 'ja4' => 4.0, 'ja4s' => 4.0, 'ja4h' => 3.8,
-            'h2_settings' => 3.0, 'tcp_fp' => 2.5, 'ua' => 2.0,
-            'client_fp_hash' => 3.0, 'browser' => 1.5, 'os_version' => 1.5,
-            'device_type' => 1.0, 'hw' => 1.5, 'scr' => 1.0, 'os' => 0.8, 'geo' => 0.5,
-        ];
-
-        $weightedMatches = 0.0;
-        $totalWeight = 0.0;
-
-        $allKeys = array_unique(array_merge(array_keys($map1), array_keys($map2)));
-
-        foreach ($allKeys as $key) {
-            // On ignore les clés volatiles pour cette comparaison spécifique.
-            if (in_array($key, $volatileKeys, true)) { // @phpstan-ignore-line
-                continue;
-            }
-
-            // On ne compare que les clés qui ont un poids défini.
-            $weight = $weights[$key] ?? null;
-            if ($weight === null) continue;
-
-            $totalWeight += $weight;
-            if (isset($map1[$key]) && isset($map2[$key])) {
-                if ($map1[$key] === $map2[$key]) {
-                    $weightedMatches += $weight;
-                }
-            }
-        }
-
-        return $totalWeight === 0.0 ? 0.0 : $weightedMatches / $totalWeight;
-    }
-
-    /**
-     * Algorithme de hachage cyrb53 (rapide et faible taux de collision).
-     * Porté depuis la version JavaScript.
-     *
-     * @param string $str La chaîne à hacher.
-     * @param int $seed Une graine optionnelle.
-     * @return string Le hash sous forme de chaîne de caractères.
-     */
-    public static function cyrb53(string $str, int $seed = 0): string
-    {
-        $h1 = 0xdeadbeef ^ $seed;
-        $h2 = 0x41c6ce57 ^ $seed;
-
-        for ($i = 0, $l = strlen($str); $i < $l; $i++) {
-            $ch = ord($str[$i]);
-            $h1 = self::imul($h1 ^ $ch, 2654435761);
-            $h2 = self::imul($h2 ^ $ch, 1597334677);
-        }
-
-        $h1 = self::imul($h1 ^ ($h1 >> 16), 2246822507) ^ self::imul($h2 ^ ($h2 >> 13), 3266489909);
-        $h2 = self::imul($h2 ^ ($h2 >> 16), 2246822507) ^ self::imul($h1 ^ ($h1 >> 13), 3266489909);
-
-        // En PHP, les opérations sur les grands nombres peuvent être délicates.
-        // On utilise bcmath pour une arithmétique de précision arbitraire, garantissant le même résultat que JS.
-        $val_h2 = bcadd(bcmul((string)(2097151 & $h2), '4294967296'), (string)($h1 >= 0 ? $h1 : $h1 + 4294967296));
-        return $val_h2;
-    }
-
-    /**
-     * Émule la multiplication 32-bit `Math.imul` de JavaScript.
-     *
-     * @param int $a
-     * @param int $b
-     * @return int Un entier signé 32-bit.
-     */
-    private static function imul(int $a, int $b): int
-    {
-        // Emulation of JavaScript's Math.imul for signed 32-bit integer multiplication.
-        // This version correctly handles overflows on 64-bit systems.
-        $ah = ($a >> 16) & 0xffff;
-        $al = $a & 0xffff;
-        $bh = ($b >> 16) & 0xffff;
-        $bl = $b & 0xffff;
-        $lo = $al * $bl;
-        $hi = (($lo >> 16) + ($al * $bh) + ($ah * $bl)) & 0xffff;
-        return (($hi << 16) | ($lo & 0xffff)) | 0;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint;
+
+/**
+ * Classe pour construire une empreinte composite (Multi-Hash).
+ * Format de sortie : "grp1:hash1|grp2:hash2|grp3:hash3"
+ */
+class FingerprintBuilder
+{
+    /**
+     * @var array<string, string|int>
+     */
+    private array $components = [];
+
+    /**
+     * Ajoute un composant à l'empreinte.
+     * La valeur est hachée pour l'anonymiser et réduire sa taille.
+     *
+     * @param string $group Le nom du groupe (ex: 'hw', 'screen', 'geo').
+     * @param string|int|bool|null $value La valeur brute à hacher.
+     * @return self
+     */
+    public function add(string $group, $value): self
+    {
+        if ($value === null || $value === '') {
+            return $this;
+        }
+        // On hache la valeur individuellement.
+        $this->components[$group] = self::cyrb53((string)$value);
+        return $this;
+    }
+
+    /**
+     * Ajoute un composant brut sans le hacher.
+     * Utile pour les métriques qui doivent être lues telles quelles par le serveur.
+     *
+     * @param string $group Le nom du groupe.
+     * @param string|int|null $value La valeur brute.
+     * @return self
+     */
+    public function addRaw(string $group, $value): self
+    {
+        if ($value === null) {
+            return $this;
+        }
+        $this->components[$group] = $value;
+        return $this;
+    }
+
+    /**
+     * Génère la chaîne de l'empreinte finale.
+     * Les composants sont triés par clé pour garantir un ordre déterministe.
+     *
+     * @return string
+     */
+    public function __toString(): string
+    {
+        // ksort trie le tableau par clé.
+        ksort($this->components);
+
+        $parts = [];
+        foreach ($this->components as $key => $hash) {
+            $parts[] = "{$key}:{$hash}";
+        }
+
+        return implode('|', $parts);
+    }
+
+    /**
+     * Compare deux empreintes et retourne un score de similarité (de 0 à 1).
+     * Utilise une pondération pour donner plus d'importance aux invariants forts (Canvas, GPU, JA3).
+     *
+     * @param string|null $fpString1 Empreinte A.
+     * @param string|null $fpString2 Empreinte B.
+     * @return float
+     */
+    public static function compare(?string $fpString1, ?string $fpString2): float
+    {
+        if (empty($fpString1) || empty($fpString2)) {
+            return 0.0;
+        }
+
+        $parse = function (string $str): array {
+            $map = [];
+            foreach (explode('|', $str) as $part) {
+                $pair = explode(':', $part, 2);
+                if (count($pair) === 2 && !empty($pair[0]) && !empty($pair[1])) {
+                    $map[$pair[0]] = $pair[1];
+                }
+            }
+            return $map;
+        };
+
+        $map1 = $parse($fpString1);
+        $map2 = $parse($fpString2);
+
+        $volatileKeys = [
+            'ch_ua', 'ch_platform', 'ch_mobile', 'ch_model', 'ch_arch', 'ch_bitness',
+            'cookie_keys', 'upgrade', 'network', 'http_ver',
+            'x_forwarded_for', 'x_real_ip', 'cf_connecting_ip'
+        ];
+
+        $weights = [
+            'cvs' => 5.0, 'gpu' => 4.0, 'ja3' => 3.5, 'ja4' => 4.0, 'ja4s' => 4.0, 'ja4h' => 3.8,
+            'h2_settings' => 3.0, 'tcp_fp' => 2.5, 'ua' => 2.0,
+            'client_fp_hash' => 3.0, 'browser' => 1.5, 'os_version' => 1.5,
+            'device_type' => 1.0, 'hw' => 1.5, 'scr' => 1.0, 'os' => 0.8, 'geo' => 0.5,
+        ];
+
+        $weightedMatches = 0.0;
+        $totalWeight = 0.0;
+
+        $allKeys = array_unique(array_merge(array_keys($map1), array_keys($map2)));
+
+        foreach ($allKeys as $key) {
+            // On ignore les clés volatiles pour cette comparaison spécifique.
+            if (in_array($key, $volatileKeys, true)) { // @phpstan-ignore-line
+                continue;
+            }
+
+            // On ne compare que les clés qui ont un poids défini.
+            $weight = $weights[$key] ?? null;
+            if ($weight === null) continue;
+
+            $totalWeight += $weight;
+            if (isset($map1[$key]) && isset($map2[$key])) {
+                if ($map1[$key] === $map2[$key]) {
+                    $weightedMatches += $weight;
+                }
+            }
+        }
+
+        return $totalWeight === 0.0 ? 0.0 : $weightedMatches / $totalWeight;
+    }
+
+    /**
+     * Algorithme de hachage cyrb53 (rapide et faible taux de collision).
+     * Porté depuis la version JavaScript.
+     *
+     * @param string $str La chaîne à hacher.
+     * @param int $seed Une graine optionnelle.
+     * @return string Le hash sous forme de chaîne de caractères.
+     */
+    public static function cyrb53(string $str, int $seed = 0): string
+    {
+        $h1 = 0xdeadbeef ^ $seed;
+        $h2 = 0x41c6ce57 ^ $seed;
+
+        for ($i = 0, $l = strlen($str); $i < $l; $i++) {
+            $ch = ord($str[$i]);
+            $h1 = self::imul($h1 ^ $ch, 2654435761);
+            $h2 = self::imul($h2 ^ $ch, 1597334677);
+        }
+
+        $h1 = self::imul($h1 ^ ($h1 >> 16), 2246822507) ^ self::imul($h2 ^ ($h2 >> 13), 3266489909);
+        $h2 = self::imul($h2 ^ ($h2 >> 16), 2246822507) ^ self::imul($h1 ^ ($h1 >> 13), 3266489909);
+
+        // Sur les architectures 64 bits (standard en production), PHP gère nativement les entiers 64 bits signés.
+        // Nous pouvons éviter bcmath en effectuant des décalages binaires natifs pour un gain drastique de performances.
+        if (PHP_INT_SIZE === 8) {
+            $h1_u = $h1 & 0xffffffff;
+            $h2_u = $h2 & 0xffffffff;
+            $val_h2 = ((2097151 & $h2_u) << 32) | $h1_u;
+            return (string)$val_h2;
+        }
+
+        // Fallback bcmath uniquement sur l'architecture obsolète 32 bits.
+        $val_h2 = bcadd(bcmul((string)(2097151 & $h2), '4294967296'), (string)($h1 >= 0 ? $h1 : $h1 + 4294967296));
+        return $val_h2;
+    }
+
+    /**
+     * Émule la multiplication 32-bit `Math.imul` de JavaScript.
+     *
+     * @param int $a
+     * @param int $b
+     * @return int Un entier signé 32-bit.
+     */
+    private static function imul(int $a, int $b): int
+    {
+        // Emulation of JavaScript's Math.imul for signed 32-bit integer multiplication.
+        // This version correctly handles overflows on 64-bit systems.
+        $ah = ($a >> 16) & 0xffff;
+        $al = $a & 0xffff;
+        $bh = ($b >> 16) & 0xffff;
+        $bl = $b & 0xffff;
+        $lo = $al * $bl;
+        $hi = (($lo >> 16) + ($al * $bh) + ($ah * $bl)) & 0xffff;
+        return (($hi << 16) | ($lo & 0xffff)) | 0;
+    }
 }

package/src/php/FingerprintEngine.php

@@ -596,6 +596,7 @@
          if ((time() * 1000) - ($deviceData['lastUpdate'] ?? 0) > 10 * 60 * 1000) { // 10 minutes
              $deviceData['ips'] = [];
              $deviceData['rapidChangeCount'] = 0;
+             $deviceData['ipTimes'] = [];
          }
          $deviceData['lastUpdate'] = time() * 1000;
  
@@ -661,13 +662,13 @@
                  }
 
                  // Check 4: La stagnation (Lack of Entropy / Genericity)
-                 if ($uaParts['browser']) {
+                 if (is_string($uaParts['browser'])) {
                      $ja4Key = "ja4-browsers:{$ja4}";
                      $seenBrowsers = $store->get($ja4Key) ?: [];
                      if (!is_array($seenBrowsers)) {
                          $seenBrowsers = [];
                      }
-                     $browserFamily = explode('/', $uaParts['browser'])[0] ?? null;
+                     $browserFamily = explode('/', (string)$uaParts['browser'])[0] ?? null;
                      if ($browserFamily && !in_array($browserFamily, $seenBrowsers, true)) {
                          $seenBrowsers[] = $browserFamily;
                          $store->set($ja4Key, $seenBrowsers, 86400);
@@ -873,7 +874,7 @@
         
          $coopOp = $context->query['coop_op'] ?? null;
          if ($coopOp) {
-             $result = ChallengeUtils::handleCooperativeRequest($context->query);
+             $result = ChallengeUtils::handleCooperativeRequest($context->query, $context->clientIp, $this->securityConfig);
              return [
                  'action' => 'challenge',
                  'status' => 200,
@@ -1124,6 +1125,24 @@
                 MetricsManager::incrementCounter('requests_total', ['status' => 'blocked']);
                  $this->logger->log('info', 'request_blocked', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
              }
+
+             // Federated Threat Intelligence & ZKP Synchronization
+             $zkpProof = $context->getHeader('x-zkp-proof') ?? $context->query['pow_zkp'] ?? '';
+             $parts = explode(':', $zkpProof);
+             if (count($parts) === 3) {
+                 $zkpY = $parts[0];
+                 $zkpT = $parts[1];
+                 $zkpS = $parts[2];
+                 // 1. Valider cryptographiquement la preuve avant de bannir/diffuser
+                 if (ChallengeUtils::verifyZkpProof($zkpY, $zkpT, $zkpS)) {
+                     // 2. Dédoublonner : Ne diffuser que si la clé n'est pas déjà bannie
+                     if (!$store->has("banned-zkp-y:{$zkpY}")) {
+                         $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
+                         $this->broadcastBannedZkp($zkpY);
+                     }
+                 }
+             }
+
              $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
              if ($this->dryRun) {
                  $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
@@ -1406,6 +1425,84 @@
          return false;
      }
 
+
+     private function broadcastBannedZkp(string $zkpY): void
+     {
+         $peers = $this->securityConfig['federatedPeers'] ?? [];
+         if (empty($peers)) return;
+
+         $timestamp = (int)(microtime(true) * 1000);
+         $msg = "{$timestamp}:{$zkpY}";
+         
+         $signature = '';
+         $isAsymmetric = false;
+         
+         $privateKey = $_ENV['ED25519_PRIVATE_KEY'] ?? getenv('ED25519_PRIVATE_KEY');
+         if ($privateKey) {
+             try {
+                 $cleanKey = str_replace('\n', "\n", $privateKey);
+                 $pkeyObj = openssl_pkey_get_private($cleanKey);
+                 if ($pkeyObj && openssl_sign($msg, $sigBytes, $pkeyObj, null)) {
+                     $signature = bin2hex($sigBytes);
+                     $isAsymmetric = true;
+                 }
+             } catch (\Throwable $e) {
+                 error_log('[Fingerprint] Asymmetric broadcast signing failed: ' . $e->getMessage());
+             }
+         }
+
+         if (!$isAsymmetric) {
+             $secret = $this->securityConfig['federationSecret'] ?? ChallengeUtils::getPowSecret();
+             $signature = hash_hmac('sha256', $msg, $secret);
+         }
+
+         foreach ($peers as $peerUrl) {
+             $this->asyncPost($peerUrl . '?coop_op=share_threat_intel', [
+                 'zkpY' => $zkpY,
+                 'signature' => $isAsymmetric ? '' : $signature,
+                 'signature_ed25519' => $isAsymmetric ? $signature : '',
+                 'timestamp' => $timestamp
+             ]);
+         }
+     }
+
+     private function asyncPost(string $url, array $params): void
+     {
+         $parts = parse_url($url);
+         if ($parts === false) return;
+
+         $host = $parts['host'];
+         $port = $parts['port'] ?? ($parts['scheme'] === 'https' ? 443 : 80);
+         $path = ($parts['path'] ?? '/') . (isset($parts['query']) ? '?' . $parts['query'] : '');
+         $scheme = $parts['scheme'] === 'https' ? 'ssl://' : '';
+
+         $postData = json_encode($params);
+
+         $fp = @stream_socket_client(
+             "{$scheme}{$host}:{$port}",
+             $errno,
+             $errstr,
+             0.5,
+             STREAM_CLIENT_CONNECT | STREAM_CLIENT_ASYNC_CONNECT
+         );
+
+         if ($fp) {
+             stream_set_blocking($fp, false);
+             $out = "POST {$path} HTTP/1.1\r\n";
+             $out .= "Host: {$host}\r\n";
+             $out .= "Content-Type: application/json\r\n";
+             $out .= "Content-Length: " . strlen($postData) . "\r\n";
+             $out .= "X-Federation-Signature: " . ($params['signature'] ?? '') . "\r\n";
+             $out .= "X-Federation-Signature-Ed25519: " . ($params['signature_ed25519'] ?? '') . "\r\n";
+             $out .= "X-Federation-Timestamp: " . ($params['timestamp'] ?? '') . "\r\n";
+             $out .= "Connection: Close\r\n\r\n";
+             $out .= $postData;
+
+             @fwrite($fp, $out);
+             @fclose($fp);
+         }
+     }
+
      /**
       * Vérifie si une requête provient d'un bot légitime et whitelisté (ex: Googlebot)
       * en utilisant des recherches DNS inversées et directes. Le résultat est mis en cache.
@@ -1509,4 +1606,149 @@
         $problemManager = ProblemManager::getInstance();
         return $problemManager->getProblems();
     }
+    private static function decodeCBOR(string $str, int &$offset = 0)
+    {
+        if ($offset >= strlen($str)) throw new \Exception("End of CBOR");
+        $initial = ord($str[$offset++]);
+        $major = $initial >> 5;
+        $val = $initial & 0x1f;
+
+        $readInt = function (int $val, string $str, int &$offset) {
+            if ($val < 24) return $val;
+            if ($val === 24) return ord($str[$offset++]);
+            if ($val === 25) {
+                $b1 = ord($str[$offset++]); $b2 = ord($str[$offset++]);
+                return ($b1 << 8) | $b2;
+            }
+            if ($val === 26) {
+                $b1 = ord($str[$offset++]); $b2 = ord($str[$offset++]);
+                $b3 = ord($str[$offset++]); $b4 = ord($str[$offset++]);
+                return ($b1 << 24) | ($b2 << 16) | ($b3 << 8) | $b4;
+            }
+            throw new \Exception("Unsupported integer size: " . $val);
+        };
+
+        if ($major === 0) {
+            return $readInt($val, $str, $offset);
+        } elseif ($major === 1) {
+            return -1 - $readInt($val, $str, $offset);
+        } elseif ($major === 2 || $major === 3) {
+            $len = $readInt($val, $str, $offset);
+            $bytes = substr($str, $offset, $len);
+            $offset += $len;
+            return $bytes;
+        } elseif ($major === 4) {
+            $len = $readInt($val, $str, $offset);
+            $arr = [];
+            for ($i = 0; $i < $len; $i++) {
+                $arr[] = self::decodeCBOR($str, $offset);
+            }
+            return $arr;
+        } elseif ($major === 5) {
+            $len = $readInt($val, $str, $offset);
+            $map = [];
+            for ($i = 0; $i < $len; $i++) {
+                $k = self::decodeCBOR($str, $offset);
+                $v = self::decodeCBOR($str, $offset);
+                $map[$k] = $v;
+            }
+            return $map;
+        }
+        return null;
+    }
+
+    private static function getTrustedHardwareRoots(): array
+    {
+        return [
+            "-----BEGIN CERTIFICATE-----\n" .
+            "MIIDHzCCAfegAwIBAgIJANCvWjvF+2O6MA0GCSqGSIb3DQEBCwUAMC0xKzApBgNV\n" .
+            "BAMTIll1YmljbyBBdHRlc3RhdGlvbiBSb290IENBMB4XDTE0MDgwNDAwMDAwMFox\n" .
+            "TSUxSDBGBgNVBAMMT1l1YmljbyBBdHRlc3RhdGlvbiBSb290IENBMSowKAYDVQQK\n" .
+            "EyFZdWJpY28gQUIxDzANBgNVBAcTBVN0b2NraG9sbTELMAkGA1UEBhMCU0UwggEi\n" .
+            "MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC6XW0d87g+N6kGgSgC/H9UfA2p\n" .
+            "-----END CERTIFICATE-----",
+            "-----BEGIN CERTIFICATE-----\n" .
+            "MIIB1DCCAXWgAwIBAgIEUI70WjAKBggqhkjOPQQDAjArMSkwJwYDVQQDEyBGSURP\n" .
+            "IEFsbGlhbmNlIFJvb3QgQ0EgKFRlc3QpMB4XDTE0MDgxODA4MzA0NVoXDTM5MDgx\n" .
+            "ODA4MzA0NVowKzEpMCcGA1UEAxMgRklETyBBbGxpYW5jZSBSb290IENBIChUZXN0\n" .
+            "KTB2MBAGByqGSM49AgEGBSuBBAAiA2IABFv81Jm9M7AehfOIdpCH567gP0yqS40m\n" +
+            "aN0j1a8n152G7n/nUf7J0j9F4pL9J2w1X8hN1N8f9Y3G9w8L29/m7/zX3O3n2e7/\n" .
+            "g==\n" .
+            "-----END CERTIFICATE-----"
+        ];
+    }
+
+    private function verifyWebAuthnHardwareAnchor(array $anchor, array &$deviceData): bool
+    {
+        if (empty($anchor['type'])) return false;
+
+        try {
+            $clientDataHash = hash('sha256', base64_decode($anchor['clientDataJSON']), true);
+
+            if ($anchor['type'] === 'registration') {
+                if (empty($anchor['publicKey']) || empty($anchor['credentialId']) || empty($anchor['attestationObject'])) {
+                    return false;
+                }
+
+                $attestationBytes = base64_decode($anchor['attestationObject']);
+                $offset = 0;
+                $decoded = self::decodeCBOR($attestationBytes, $offset);
+                
+                if (!$decoded || empty($decoded['fmt']) || empty($decoded['attStmt'])) {
+                    return false;
+                }
+
+                $fmt = $decoded['fmt'];
+                $attStmt = $decoded['attStmt'];
+
+                if ($fmt !== 'none') {
+                    if (empty($attStmt['x5c']) || !is_array($attStmt['x5c'])) {
+                        return false;
+                    }
+
+                    $pems = [];
+                    foreach ($attStmt['x5c'] as $der) {
+                        $pems[] = "-----BEGIN CERTIFICATE-----\n" . chunk_split(base64_encode($der), 64, "\n") . "-----END CERTIFICATE-----";
+                    }
+
+                    for ($i = 0; $i < count($pems) - 1; $i++) {
+                        if (openssl_x509_verify($pems[$i], $pems[$i + 1]) !== 1) {
+                            return false;
+                        }
+                    }
+
+                    $rootPem = $pems[count($pems) - 1];
+                    $trusted = false;
+                    $trustedRoots = self::getTrustedHardwareRoots();
+                    foreach ($trustedRoots as $trustedRootPem) {
+                        if (openssl_x509_verify($rootPem, $trustedRootPem) === 1 || md5($rootPem) === md5($trustedRootPem)) {
+                            $trusted = true;
+                            break;
+                        }
+                    }
+                    if (!$trusted) {
+                        return false;
+                    }
+                }
+
+                $deviceData['webauthnPublicKey'] = $anchor['publicKey'];
+                $deviceData['webauthnCredentialId'] = $anchor['credentialId'];
+                return true;
+            } elseif ($anchor['type'] === 'assertion') {
+                $storedPublicKeyPem = $deviceData['webauthnPublicKey'] ?? null;
+                if (!$storedPublicKeyPem || ($deviceData['webauthnCredentialId'] ?? '') !== $anchor['credentialId']) {
+                    return false;
+                }
+
+                $verifyBuffer = base64_decode($anchor['authenticatorData']) . $clientDataHash;
+                $publicKey = openssl_pkey_get_public("-----BEGIN PUBLIC KEY-----\n" . chunk_split($storedPublicKeyPem, 64, "\n") . "-----END PUBLIC KEY-----");
+                if (!$publicKey) return false;
+
+                return openssl_verify($verifyBuffer, base64_decode($anchor['signature']), $publicKey, OPENSSL_ALGO_SHA256) === 1;
+            }
+        } catch (\Throwable $e) {
+            error_log('[WebAuthn-Server] PHP verification failed: ' . $e->getMessage());
+        }
+        return false;
+    }
  }