@anonympins/fingerprint 0.6.0 → 0.6.1

package/src/js/fingerprint.js

@@ -63,6 +63,58 @@ function canAttemptDns() {
   return true; // HALF-OPEN
 }
 
+/**
+ * Diffuse un ZKP banni aux pairs fédérés de manière asynchrone (non-bloquante).
+ * @private
+ * @param {string} zkpY - La clé publique ZKP du terminal banni.
+ * @param {object} config - La configuration de sécurité.
+ */
+async function broadcastBannedZkp(zkpY, config) {
+    const peers = config.federatedPeers || [];
+    if (peers.length === 0) return;
+
+    const timestamp = Date.now();
+    const msg = `${timestamp}:${zkpY}`;
+    
+    let signature = '';
+    let isAsymmetric = false;
+
+    if (process.env.ED25519_PRIVATE_KEY) {
+        try {
+            const cleanKey = process.env.ED25519_PRIVATE_KEY.replace(/\\n/g, '\n');
+            const signBuffer = crypto.sign(null, Buffer.from(msg), {
+                key: cleanKey,
+                format: 'pem',
+                type: 'pkcs8'
+            });
+            signature = signBuffer.toString('hex');
+            isAsymmetric = true;
+        } catch (e) {
+            console.error('[Fingerprint] Asymmetric broadcast signing failed, falling back to HMAC:', e.message);
+        }
+    }
+
+    if (!isAsymmetric) {
+        const secret = config.federationSecret || getPowSecret();
+        signature = crypto.createHmac('sha256', secret).update(msg).digest('hex');
+    }
+
+    peers.forEach(peerUrl => {
+        fetch(peerUrl + '?coop_op=share_threat_intel', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                'X-Federation-Signature': isAsymmetric ? '' : signature,
+                'X-Federation-Signature-Ed25519': isAsymmetric ? signature : '',
+                'X-Federation-Timestamp': String(timestamp)
+            },
+            body: JSON.stringify({ zkpY })
+        }).catch(() => {
+            // Échec de propagation silencieux pour ne pas perturber le thread principal
+        });
+    });
+}
+
 const withTimeout = (promise, ms) => {
   let timeoutId;
   const timeoutPromise = new Promise((_, reject) => {
@@ -494,7 +546,8 @@ const securityProfiles = {
             botnetClusterScore: 0.6, // NOUVEAU: Poids pour le clustering botnet
             tcpAnomalyScore: 0.8, // NEW: Anomalie de pile TCP/IP
             quicAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie QUIC
-            renderingAnomalyScore: 0.8 // NOUVEAU: Poids pour l'anomalie de rendu
+            renderingAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie de rendu
+            threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
         patterns: {
@@ -511,6 +564,7 @@ const securityProfiles = {
         },
         allowCrossNetworkRoaming: true, // Profil balancé : tolérant par défaut
     wasm: true,
+        useAsymmetricTickets: true,
     },
     /**
      * @summary **Strict Profile**
@@ -531,7 +585,8 @@ const securityProfiles = {
             subnetScore: 0.5,
             ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
             botnetClusterScore: 0.8, // NOUVEAU: Poids pour le clustering botnet
-            renderingAnomalyScore: 1.0 // NOUVEAU: Poids pour l'anomalie de rendu
+            renderingAnomalyScore: 1.0, // NOUVEAU: Poids pour l'anomalie de rendu
+            threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
         patterns: {
@@ -549,6 +604,7 @@ const securityProfiles = {
         challengeNewDevices: true, // Challenge all new devices
         allowCrossNetworkRoaming: false, // Strict : interdiction de changer complètement de réseau sans re-challenge
     wasm: true,
+        useAsymmetricTickets: true,
     },
     /**
      * @summary **API Profile**
@@ -588,6 +644,7 @@ const securityProfiles = {
         isApiRequest: (req) => req.path.startsWith('/api/') || req.headers.accept?.includes('application/json'),
         allowCrossNetworkRoaming: false, // Les API ne doivent pas subir de roaming inter-IP suspect
     wasm: true,
+        useAsymmetricTickets: true,
     }
     ,
     /**
@@ -611,7 +668,8 @@ const securityProfiles = {
             botnetClusterScore: 0.5, // NOUVEAU: Poids pour le clustering botnet
             tcpAnomalyScore: 0.5, // NEW: Anomalie de pile TCP/IP
             quicAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie QUIC
-            renderingAnomalyScore: 0.5 // NOUVEAU: Poids pour l'anomalie de rendu
+            renderingAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie de rendu
+            threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -628,6 +686,7 @@ const securityProfiles = {
         },
         allowCrossNetworkRoaming: true,
     wasm: true,
+        useAsymmetricTickets: true,
     },
     /**
      * @summary **E-commerce Profile**
@@ -651,7 +710,8 @@ const securityProfiles = {
             botnetClusterScore: 0.9, // NOUVEAU: Poids pour le clustering botnet
             tcpAnomalyScore: 0.9, // NEW: Anomalie de pile TCP/IP
             quicAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie QUIC
-            renderingAnomalyScore: 0.9 // NOUVEAU: Poids pour l'anomalie de rendu
+            renderingAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie de rendu,threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
+            threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -670,6 +730,7 @@ const securityProfiles = {
         isApiRequest: (req) => req.path.startsWith('/api/cart') || req.path.startsWith('/api/stock') || req.path.startsWith('/api/checkout'),
         allowCrossNetworkRoaming: false, // E-commerce : interdiction de changer de réseau sans re-challenge
     wasm: true,
+        useAsymmetricTickets: true,
     }
 };
 
@@ -3294,15 +3355,20 @@ export const getSuspicionVector = async (context, securityConfig) => {
   const stableFpHash = cyrb53(stableFp).toString();
 
       // Execute non-interdependent asynchronous operations in parallel
-      const [
+    const zkpProof = (context.getHeader ? context.getHeader('x-zkp-proof') : null) || (context.headers ? context.headers['x-zkp-proof'] : null) || (context.query ? context.query['pow_zkp'] : null) || (context.queryParams ? context.queryParams['pow_zkp'] : null) || '';
+    const zkpY = zkpProof ? zkpProof.split(":")[0] : null;
+
+    const [
         behavioral,
+        { threatIntelScore },
         { tlsSpoofingScore },
         { subnetScore },
         ipReputationScore,
         { botnetClusterScore },
         _ // store.set result
       ] = await Promise.all([
-        getBehavioralIndicators(context, deviceData),
+        getBehavioralIndicators(context, deviceData), // This modifies deviceData, so it must be done before saving deviceData
+        getThreatIntelScore(zkpY), // NOUVEAU: Score de Threat Intelligence Fédéré
         getTlsSpoofingScore(context),
         getSubnetScore(context, deviceId),
         getIpReputationScore(clientIp),
@@ -3354,7 +3420,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, quicAnomalyScore, renderingAnomalyScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, quicAnomalyScore, renderingAnomalyScore, threatIntelScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -3729,6 +3795,22 @@ function parseGraphQLQuery(body) {
     }
     return null;
 }
+
+/**
+ * Calculates a score based on whether the client's ZKP public key (y) is found in a banned list.
+ * @param {string} zkpY - The 'y' component of the ZKP proof (public key).
+ * @returns {Promise<{threatIntelScore: number}>}
+ */
+async function getThreatIntelScore(zkpY) {
+    if (!zkpY) return { threatIntelScore: 0 };
+
+    const isBanned = await store.has(`banned-zkp-y:${zkpY}`);
+    if (isBanned) {
+        return { threatIntelScore: 100 };
+    }
+    return { threatIntelScore: 0 };
+}
+
 export class FingerprintEngine {
   constructor(securityConfig) {
     const isProduction = process.env.NODE_ENV === 'production';
@@ -3741,6 +3823,20 @@ export class FingerprintEngine {
       process.env.ED25519_PUBLIC_KEY = securityConfig.ed25519_public_key;
     }
 
+        // Auto-generate Ed25519 key pair on load if indicated and keys are not set
+        if (securityConfig && (securityConfig.useAsymmetricTickets || securityConfig.ed25519 === 'auto') && !process.env.ED25519_PRIVATE_KEY) {
+          try {
+            const { privateKey, publicKey } = crypto.generateKeyPairSync('ed25519', {
+              privateKeyEncoding: { format: 'pem', type: 'pkcs8' },
+              publicKeyEncoding: { format: 'pem', type: 'spki' }
+            });
+            process.env.ED25519_PRIVATE_KEY = privateKey;
+            process.env.ED25519_PUBLIC_KEY = publicKey;
+          } catch (e) {
+            console.error('[Fingerprint] Native Ed25519 key generation failed:', e.message);
+          }
+        }
+
     let finalConfig = securityConfig;
     if (securityConfig && securityConfig.autotuning && securityConfig.autotuning.savePath) {
       const sPath = securityConfig.autotuning.savePath;
@@ -3792,7 +3888,8 @@ export class FingerprintEngine {
       'trustedProxies',
       'wasm',
       'similarityThreshold',
-      'ed25519_private_key', 'ed25519_public_key'
+      'ed25519_private_key', 'ed25519_public_key',
+      'federatedPeers', 'federationSecret'
     ]);
 
     // 1. Check for essential keys
@@ -3839,10 +3936,13 @@ export class FingerprintEngine {
             (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0) +
             (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0) +
             (suspicionVector.quicAnomalyScore || 0) * (weights.quicAnomalyScore || 0) + // NOUVEAU: QUIC Anomaly
+            (suspicionVector.threatIntelScore || 0) * (weights.threatIntelScore || 0) + // NOUVEAU: QUIC Anomaly
             (suspicionVector.renderingAnomalyScore || 0) * (weights.renderingAnomalyScore || 0); // NOUVEAU: Rendering Anomaly
 
         return Math.min(100, score);
     }
+
+
   /**
    * Checks if an IP address is in the static allowlist (IPs or CIDR ranges).
    * This is the fastest check and should be performed first.
@@ -4107,7 +4207,13 @@ export class FingerprintEngine {
       const { clientIp = "unknown", path, cookies = {}, query = {}, isStatic, graphqlOperationType, graphqlOperationName } = requestContext;
 
       if (query.coop_op) {
-          const result = await handleCooperativeRequest(query, clientIp);
+          const coopParams = {
+              ...query,
+              signature: requestContext.headers?.['x-federation-signature'] || query.signature,
+              signature_ed25519: requestContext.headers?.['x-federation-signature-ed25519'] || query.signature_ed25519,
+              timestamp: requestContext.headers?.['x-federation-timestamp'] || query.timestamp
+          };
+          const result = await handleCooperativeRequest(coopParams, clientIp, this.securityConfig);
           return {
               action: 'challenge',
               status: 200,
@@ -4550,6 +4656,22 @@ export class FingerprintEngine {
 
     const isBlocked = finalScore >= blockThreshold;
 
+// NOUVEAU: Si l'action est de bloquer, on enregistre le ZKP du client dans la liste des bannis.
+      if (isBlocked) {
+          const zkpProof = requestContext.headers['x-zkp-proof'] || requestContext.query.pow_zkp || '';
+          const parts = zkpProof.split(':');
+          if (parts.length === 3) {
+              const [zkpY, zkpT, zkpS] = parts;
+              // 1. Valider cryptographiquement la preuve avant de bannir/diffuser
+              if (verifyZkpProof(zkpY, zkpT, zkpS)) {
+                  // 2. Dédoublonner : Ne diffuser que si la clé n'est pas déjà connue comme bannie
+                  if (!(await store.has(`banned-zkp-y:${zkpY}`))) {
+                      await store.set(`banned-zkp-y:${zkpY}`, true, 86400 * 30); // Banni pour 30 jours
+                      broadcastBannedZkp(zkpY, this.securityConfig).catch(() => {});
+                  }
+              }
+          }
+      }
     const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked && finalScore > 0;
     const isSuspiciousMedium = finalScore >= thresholds.medium;
     const isSuspicious = finalScore >= thresholds.low;
@@ -4970,10 +5092,77 @@ export async function findPeerInSubnet(clientIp, excludeNodeId) {
     return activePeers[randomIndex];
 }
 
-export async function handleCooperativeRequest(params, clientIp = '127.0.0.1') {
+export async function handleCooperativeRequest(params, clientIp = '127.0.0.1', config = {}) {
     const op = params.coop_op;
     if (!op) return null;
 
+    if (op === 'share_threat_intel') {
+        const peers = config.federatedPeers || [];
+        if (peers.length > 0) {
+            const allowedIPsAndHosts = peers.map(url => {
+                try { return new URL(url).hostname; } catch(e) { return url; }
+            });
+            if (!allowedIPsAndHosts.includes(clientIp)) {
+                return { error: 'Unauthorized federation sender IP' };
+            }
+        }
+        const zkpY = params.zkpY || '';
+        const timestamp = Number(params.timestamp || 0);
+
+        if (!zkpY || !timestamp) {
+            return { error: 'Missing threat intel parameters' };
+        }
+
+        // Vérification de la fraîcheur du message pour éviter les attaques par rejeu
+        if (Math.abs(Date.now() - timestamp) > 300000) { // 5 minutes max skew
+            return { error: 'Message expired or clock skew too high' };
+        }
+
+        const msg = `${timestamp}:${zkpY}`;
+        const sigEd25519 = params.signature_ed25519 || '';
+        const sigHmac = params.signature || '';
+
+        if (sigEd25519) {
+            const publicKey = config.ed25519_public_key || process.env.ED25519_PUBLIC_KEY;
+            if (!publicKey) {
+                return { error: 'Missing public key for asymmetric verification' };
+            }
+            try {
+                const cleanKey = publicKey.replace(/\\n/g, '\n');
+                const isVerified = crypto.verify(
+                    null,
+                    Buffer.from(msg),
+                    { key: cleanKey, format: 'pem', type: 'spki' },
+                    Buffer.from(sigEd25519, 'hex')
+                );
+                if (!isVerified) {
+                    return { error: 'Invalid asymmetric federation signature' };
+                }
+            } catch (e) {
+                return { error: 'Asymmetric signature verification failed' };
+            }
+        } else if (sigHmac) {
+            const secret = config.federationSecret || getPowSecret();
+            const expectedSig = crypto.createHmac('sha256', secret).update(msg).digest('hex');
+            try {
+                const isSigValid = crypto.timingSafeEqual(
+                    Buffer.from(sigHmac, 'hex'),
+                    Buffer.from(expectedSig, 'hex')
+                );
+                if (!isSigValid) {
+                    return { error: 'Invalid federation signature' };
+                }
+            } catch (e) {
+                return { error: 'Invalid signature verification' };
+            }
+        } else {
+            return { error: 'Missing signature' };
+        }
+
+        await store.set(`banned-zkp-y:${zkpY}`, true, 86400 * 30); // 30 jours
+        return { status: 'synchronized' };
+    }
+
     const nodeId = params.node_id || '';
     if (!nodeId) {
         return { error: 'Missing node_id' };
@@ -5916,7 +6105,8 @@ export const __internal = {
     canAttemptDns,
     registerCooperativeNode,
     findPeerInSubnet,
-    handleCooperativeRequest
+    handleCooperativeRequest,
+    broadcastBannedZkp
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---

package/src/js/tests/cross_parity.test.js

@@ -140,21 +140,27 @@ describe('Cross-Parity Chaos PoW Floating Point Parity (JS vs WASM vs PHP)', ()
     it('should verify bit-to-bit convergence across 1,000 different seeds', () => {
         const iterations = 100;
         for (let i = 0; i < 50; i++) {
-            const seed = `seed_parity_val_${i}`;
-            const jsTrajectory = jsGenerateTrajectory(seed, iterations);
-            const phpTrajectory = runPhpTrajectory(seed, iterations);
+            const seed = `seed_parity_val_${i}`; // Use a unique seed for each iteration
+            const jsTrajectory = jsGenerateTrajectory(seed, iterations); // Generate trajectory using JS
+            const phpTrajectory = runPhpTrajectory(seed, iterations); // Generate trajectory using PHP
 
             for (let idx = 0; idx < 64; idx++) {
                 const jsVal = Math.fround(jsTrajectory[idx]);
                 const phpVal = Math.fround(phpTrajectory[idx]);
-                expect(jsVal).toBe(phpVal);
+                expect(jsVal).toBe(phpVal, `PHP and JS trajectories mismatch at index ${idx} for seed "${seed}"`);
             }
 
             if (wasmModule && typeof wasmModule._generate_gpu_pow_trajectory === 'function') {
-                const outputPtr = wasmModule._malloc(256);
-                const seedPtr = wasmModule._malloc(seed.length + 1);
-                for (let s = 0; s < seed.length; s++) {
-                    wasmModule.HEAP8[seedPtr + s] = seed.charCodeAt(s);
+                // Ensure _malloc and HEAP8 are available on the wasmModule
+                if (typeof wasmModule._malloc !== 'function' || wasmModule.HEAP8 == null) {
+                    console.warn("WASM module is missing _malloc or HEAP8. Skipping WASM parity test.");
+                    continue; // Skip WASM part of the test if prerequisites are not met
+                }
+
+                const outputPtr = wasmModule._malloc(256); // Allocate memory for 64 floats (64 * 4 bytes)
+                const seedPtr = wasmModule._malloc(seed.length + 1); // Allocate memory for seed string + null terminator
+                for (let s = 0; s < seed.length; s++) { // Copy seed string to WASM memory
+                    wasmModule.HEAP8[seedPtr + s] = seed.charCodeAt(s); // HEAP8 is Int8Array
                 }
                 wasmModule.HEAP8[seedPtr + seed.length] = 0;
 
@@ -163,13 +169,13 @@ describe('Cross-Parity Chaos PoW Floating Point Parity (JS vs WASM vs PHP)', ()
                 const wasmOutput = new Float32Array(wasmModule.HEAPF32.buffer, outputPtr, 64);
                 for (let idx = 0; idx < 64; idx++) {
                     const jsVal = Math.fround(jsTrajectory[idx]);
-                    const wasmVal = Math.fround(wasmOutput[idx]);
-                    expect(jsVal).toBe(wasmVal);
+                    const wasmVal = Math.fround(wasmOutput[idx]); // Ensure float32 precision for comparison
+                    expect(jsVal).toBe(wasmVal, `WASM and JS trajectories mismatch at index ${idx} for seed "${seed}"`);
                 }
 
                 wasmModule._free(outputPtr);
                 wasmModule._free(seedPtr);
             }
         }
-    }, 20000);
+    }, 30000); // Increased timeout for potentially longer WASM compilation/execution
 });

package/src/php/Challenge/ChallengeUtils.php

@@ -138,7 +138,7 @@ class ChallengeUtils
         return $activePeers[array_rand($activePeers)];
     }
 
-    public static function handleCooperativeRequest(array $params): ?array
+    public static function handleCooperativeRequest(array $params, string $clientIp = '127.0.0.1', array $config = []): ?array
     {
         $op = $params['coop_op'] ?? null;
         if (!$op) {
@@ -146,6 +146,67 @@ class ChallengeUtils
         }
 
         $store = StoreManager::getStore();
+
+
+        if ($op === 'share_threat_intel') {
+            $peers = $config['federatedPeers'] ?? [];
+            if (!empty($peers)) {
+                $allowedHosts = array_map(function ($url) {
+                    $host = parse_url($url, PHP_URL_HOST);
+                    return !empty($host) ? $host : $url;
+                }, $peers);
+
+                if (!in_array($clientIp, $allowedHosts, true)) {
+                    return ['error' => 'Unauthorized federation sender IP'];
+                }
+            }
+            $zkpY = $params['zkpY'] ?? '';
+            $headers = function_exists('getallheaders') ? array_change_key_case(getallheaders(), CASE_LOWER) : [];
+            $sigEd25519 = $params['signature_ed25519'] ?? $headers['x-federation-signature-ed25519'] ?? $_SERVER['HTTP_X_FEDERATION_SIGNATURE_ED25519'] ?? '';
+            $sigHmac = $params['signature'] ?? $headers['x-federation-signature'] ?? $_SERVER['HTTP_X_FEDERATION_SIGNATURE'] ?? '';
+            $timestamp = (int)($params['timestamp'] ?? $headers['x-federation-timestamp'] ?? $_SERVER['HTTP_X_FEDERATION_TIMESTAMP'] ?? 0);
+
+            if (empty($zkpY) || empty($timestamp)) {
+                return ['error' => 'Missing threat intel parameters'];
+            }
+
+            // Time window check (5 minutes anti-replay)
+            $now = (int)(microtime(true) * 1000);
+            if (abs($now - $timestamp) > 300000) {
+                return ['error' => 'Message expired or clock skew too high'];
+            }
+
+            $msg = "{$timestamp}:{$zkpY}";
+
+            if (!empty($sigEd25519)) {
+                $publicKey = $config['ed25519_public_key'] ?? $_ENV['ED25519_PUBLIC_KEY'] ?? getenv('ED25519_PUBLIC_KEY');
+                if (!$publicKey) {
+                    return ['error' => 'Missing public key for asymmetric verification'];
+                }
+                try {
+                    $cleanKey = str_replace('\n', "\n", $publicKey);
+                    $pubKeyObj = openssl_pkey_get_public($cleanKey);
+                    if (!$pubKeyObj || openssl_verify($msg, hex2bin($sigEd25519), $pubKeyObj, null) !== 1) {
+                        return ['error' => 'Invalid asymmetric federation signature'];
+                    }
+                } catch (\Throwable $e) {
+                    return ['error' => 'Asymmetric signature verification failed'];
+                }
+            } elseif (!empty($sigHmac)) {
+                $secret = $params['federationSecret'] ?? $config['federationSecret'] ?? self::getPowSecret();
+                $expectedSig = hash_hmac('sha256', $msg, $secret);
+                if (!hash_equals($expectedSig, $sigHmac)) {
+                    return ['error' => 'Invalid federation signature'];
+                }
+            } else {
+                return ['error' => 'Missing signature'];
+            }
+
+            // Ban the ZKP public key for 30 days
+            $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
+            return ['status' => 'synchronized'];
+        }
+
         $nodeId = $params['node_id'] ?? '';
         if (empty($nodeId)) {
             return ['error' => 'Missing node_id'];
@@ -334,7 +395,7 @@ class ChallengeUtils
     /**
      * Récupère la clé secrète pour les PoW depuis les variables d'environnement.
      */
-    private static function getPowSecret(): string
+    public static function getPowSecret(): string
     {
         $secret = $_ENV['POW_SECRET'] ?? getenv('POW_SECRET');
         if (!$secret && ($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production') {

package/src/php/FingerprintEngine.php

@@ -662,13 +662,13 @@
                  }
 
                  // Check 4: La stagnation (Lack of Entropy / Genericity)
-                 if ($uaParts['browser']) {
+                 if (is_string($uaParts['browser'])) {
                      $ja4Key = "ja4-browsers:{$ja4}";
                      $seenBrowsers = $store->get($ja4Key) ?: [];
                      if (!is_array($seenBrowsers)) {
                          $seenBrowsers = [];
                      }
-                     $browserFamily = explode('/', $uaParts['browser'])[0] ?? null;
+                     $browserFamily = explode('/', (string)$uaParts['browser'])[0] ?? null;
                      if ($browserFamily && !in_array($browserFamily, $seenBrowsers, true)) {
                          $seenBrowsers[] = $browserFamily;
                          $store->set($ja4Key, $seenBrowsers, 86400);
@@ -874,7 +874,7 @@
         
          $coopOp = $context->query['coop_op'] ?? null;
          if ($coopOp) {
-             $result = ChallengeUtils::handleCooperativeRequest($context->query);
+             $result = ChallengeUtils::handleCooperativeRequest($context->query, $context->clientIp, $this->securityConfig);
              return [
                  'action' => 'challenge',
                  'status' => 200,
@@ -1125,6 +1125,24 @@
                 MetricsManager::incrementCounter('requests_total', ['status' => 'blocked']);
                  $this->logger->log('info', 'request_blocked', ['deviceId' => $deviceId, 'score' => $finalScore, 'vector' => $suspicionVector]);
              }
+
+             // Federated Threat Intelligence & ZKP Synchronization
+             $zkpProof = $context->getHeader('x-zkp-proof') ?? $context->query['pow_zkp'] ?? '';
+             $parts = explode(':', $zkpProof);
+             if (count($parts) === 3) {
+                 $zkpY = $parts[0];
+                 $zkpT = $parts[1];
+                 $zkpS = $parts[2];
+                 // 1. Valider cryptographiquement la preuve avant de bannir/diffuser
+                 if (ChallengeUtils::verifyZkpProof($zkpY, $zkpT, $zkpS)) {
+                     // 2. Dédoublonner : Ne diffuser que si la clé n'est pas déjà bannie
+                     if (!$store->has("banned-zkp-y:{$zkpY}")) {
+                         $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
+                         $this->broadcastBannedZkp($zkpY);
+                     }
+                 }
+             }
+
              $decision = ['action' => 'block', 'status' => 403, 'body' => 'Forbidden', 'score' => $finalScore, 'vector' => $suspicionVector];
              if ($this->dryRun) {
                  $this->log("[Dry Run] Intended action: {$decision['action']}", ['score' => $decision['score']]);
@@ -1407,6 +1425,84 @@
          return false;
      }
 
+
+     private function broadcastBannedZkp(string $zkpY): void
+     {
+         $peers = $this->securityConfig['federatedPeers'] ?? [];
+         if (empty($peers)) return;
+
+         $timestamp = (int)(microtime(true) * 1000);
+         $msg = "{$timestamp}:{$zkpY}";
+         
+         $signature = '';
+         $isAsymmetric = false;
+         
+         $privateKey = $_ENV['ED25519_PRIVATE_KEY'] ?? getenv('ED25519_PRIVATE_KEY');
+         if ($privateKey) {
+             try {
+                 $cleanKey = str_replace('\n', "\n", $privateKey);
+                 $pkeyObj = openssl_pkey_get_private($cleanKey);
+                 if ($pkeyObj && openssl_sign($msg, $sigBytes, $pkeyObj, null)) {
+                     $signature = bin2hex($sigBytes);
+                     $isAsymmetric = true;
+                 }
+             } catch (\Throwable $e) {
+                 error_log('[Fingerprint] Asymmetric broadcast signing failed: ' . $e->getMessage());
+             }
+         }
+
+         if (!$isAsymmetric) {
+             $secret = $this->securityConfig['federationSecret'] ?? ChallengeUtils::getPowSecret();
+             $signature = hash_hmac('sha256', $msg, $secret);
+         }
+
+         foreach ($peers as $peerUrl) {
+             $this->asyncPost($peerUrl . '?coop_op=share_threat_intel', [
+                 'zkpY' => $zkpY,
+                 'signature' => $isAsymmetric ? '' : $signature,
+                 'signature_ed25519' => $isAsymmetric ? $signature : '',
+                 'timestamp' => $timestamp
+             ]);
+         }
+     }
+
+     private function asyncPost(string $url, array $params): void
+     {
+         $parts = parse_url($url);
+         if ($parts === false) return;
+
+         $host = $parts['host'];
+         $port = $parts['port'] ?? ($parts['scheme'] === 'https' ? 443 : 80);
+         $path = ($parts['path'] ?? '/') . (isset($parts['query']) ? '?' . $parts['query'] : '');
+         $scheme = $parts['scheme'] === 'https' ? 'ssl://' : '';
+
+         $postData = json_encode($params);
+
+         $fp = @stream_socket_client(
+             "{$scheme}{$host}:{$port}",
+             $errno,
+             $errstr,
+             0.5,
+             STREAM_CLIENT_CONNECT | STREAM_CLIENT_ASYNC_CONNECT
+         );
+
+         if ($fp) {
+             stream_set_blocking($fp, false);
+             $out = "POST {$path} HTTP/1.1\r\n";
+             $out .= "Host: {$host}\r\n";
+             $out .= "Content-Type: application/json\r\n";
+             $out .= "Content-Length: " . strlen($postData) . "\r\n";
+             $out .= "X-Federation-Signature: " . ($params['signature'] ?? '') . "\r\n";
+             $out .= "X-Federation-Signature-Ed25519: " . ($params['signature_ed25519'] ?? '') . "\r\n";
+             $out .= "X-Federation-Timestamp: " . ($params['timestamp'] ?? '') . "\r\n";
+             $out .= "Connection: Close\r\n\r\n";
+             $out .= $postData;
+
+             @fwrite($fp, $out);
+             @fclose($fp);
+         }
+     }
+
      /**
       * Vérifie si une requête provient d'un bot légitime et whitelisté (ex: Googlebot)
       * en utilisant des recherches DNS inversées et directes. Le résultat est mis en cache.

package/src/php/RequestContext.php

@@ -40,6 +40,7 @@ class RequestContext
     public ?string $http2Fingerprint = null;
     public ?string $quicFingerprint = null;
     public ?string $tcpFingerprint = null;
+    public ?string $zkpY = null; // NOUVEAU: Clé publique ZKP du client
 
     /**
      * @param string $clientIp
@@ -79,6 +80,7 @@ class RequestContext
         $this->http2Fingerprint = $this->headers['x-http2-fingerprint'] ?? null;
         $this->tcpFingerprint = $this->headers['x-tcp-fingerprint'] ?? null;
         $this->quicFingerprint = $this->headers['x-quic-fp'] ?? null;
+        $this->zkpY = isset($this->headers['x-zkp-proof']) ? explode(':', $this->headers['x-zkp-proof'])[0] : null;
         $this->tlsSessionId = $this->headers['x-tls-session-id'] ?? $this->headers['x-ssl-session-id'] ?? null;
     }
     /**

package/src/php/Utils/RequestUtils.php

@@ -1025,7 +1025,13 @@ class RequestUtils
 
     public static function getThreatIntelScore(RequestContext $context, array $threatIntelConfig): array
     {
-        return ['threatIntelScore' => 0.0];
+        $zkpY = $context->zkpY;
+        if (empty($zkpY)) {
+            return ['threatIntelScore' => 0.0];
+        }
+        $store = StoreManager::getStore();
+        $isBanned = $store->has("banned-zkp-y:{$zkpY}");
+        return ['threatIntelScore' => $isBanned ? 100.0 : 0.0];
     }
 
     /**