attack-tree.md

Attack Tree Analysis for jedisct1/libsodium

Objective: Compromise application using libsodium by exploiting weaknesses or vulnerabilities within libsodium itself. (Focus on High-Risk Paths)

Attack Tree Visualization

Compromise Application Using Libsodium [ROOT - CRITICAL NODE]

• Exploit Application Misuse of Libsodium API [HIGH-RISK PATH] [CRITICAL NODE]
  • Incorrect Key Management [HIGH-RISK PATH] [CRITICAL NODE]
    • Weak Key Generation [HIGH-RISK PATH]
      • Using Predictable Random Number Generators (outside libsodium's secure RNG) [HIGH-RISK PATH] [CRITICAL NODE]
    • Insecure Key Storage [HIGH-RISK PATH]
      • Storing Keys in Plaintext in Files or Databases [HIGH-RISK PATH] [CRITICAL NODE]
  • Nonce/IV Reuse [HIGH-RISK PATH] [CRITICAL NODE]
    • Incorrect Nonce Generation [HIGH-RISK PATH]
      • Using Predictable Nonces (e.g., sequential or time-based without sufficient entropy) [HIGH-RISK PATH] [CRITICAL NODE]
    • Nonce Reuse in Encryption [HIGH-RISK PATH]
      • Logic Error in Nonce Tracking/Management [HIGH-RISK PATH] [CRITICAL NODE]
  • Incorrect Parameter Usage [HIGH-RISK PATH] [CRITICAL NODE]
    • Wrong Data Lengths [HIGH-RISK PATH]
      • Passing Incorrect Buffer Sizes to Libsodium Functions [HIGH-RISK PATH] [CRITICAL NODE]
      • Mismatched Input/Output Buffer Sizes [HIGH-RISK PATH] [CRITICAL NODE]
  • Improper Error Handling [HIGH-RISK PATH] [CRITICAL NODE]
    • Ignoring Return Codes from Libsodium Functions [HIGH-RISK PATH]
      • Not Checking for crypto_*_VERIFY_FAIL or other error codes [HIGH-RISK PATH] [CRITICAL NODE]
      • Assuming Success When Libsodium Function Fails [HIGH-RISK PATH] [CRITICAL NODE]
  • Timing Attacks on Application Logic [HIGH-RISK PATH] [CRITICAL NODE]
    • Timing Differences in Application Code Revealing Secret Data [HIGH-RISK PATH]
      • String Comparison of Secrets [HIGH-RISK PATH] [CRITICAL NODE]

Attack Tree Path: 1. Exploit Application Misuse of Libsodium API [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Developers incorrectly use libsodium's API, leading to vulnerabilities in the application's cryptographic implementation. This is a broad category encompassing various specific misuses.
• Impact: Can range from weakened cryptography to complete compromise of confidentiality, integrity, and availability of data protected by libsodium.
• Likelihood: Medium to High, as developer errors in API usage are common.
• Effort: Low to Medium, depending on the specific misuse.
• Skill Level: Low to Medium, often requiring basic programming skills and some understanding of cryptography, but not deep expertise.

Attack Tree Path: 2. Incorrect Key Management [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Flaws in how the application generates, stores, or handles cryptographic keys.

• Impact: Critical, as compromised keys directly lead to the ability to decrypt encrypted data, forge signatures, and bypass authentication.

• Likelihood: Medium, due to common misunderstandings and oversights in key management practices.

• Effort: Low to Medium, depending on the specific key management flaw.

• Skill Level: Low to Medium.

  • 2.1. Weak Key Generation [HIGH-RISK PATH]:
    • Attack Vector: Generating keys using predictable or insufficiently random methods.
    • Impact: Critical, keys can be easily guessed or brute-forced.
    • Likelihood: Medium, especially if developers bypass libsodium's secure key generation functions.
    • Effort: Low, attacker can use standard cryptanalysis tools.
    • Skill Level: Low to Medium.
      • 2.1.1. Using Predictable Random Number Generators (outside libsodium's secure RNG) [HIGH-RISK PATH] [CRITICAL NODE]:
        • Attack Vector: Application uses standard, non-cryptographically secure RNGs (like rand() in C or similar in other languages) instead of libsodium's provided secure RNG functions (e.g., randombytes_buf()).
        • Impact: Critical, generated keys are predictable and easily compromised.
        • Likelihood: Medium, a common mistake for developers unfamiliar with secure cryptography.
        • Effort: Low, attacker can predict keys based on the weak RNG's seed or output patterns.
        • Skill Level: Low.
    • 2.2. Insecure Key Storage [HIGH-RISK PATH]:
      • Attack Vector: Storing keys in a way that is easily accessible to attackers.
      • Impact: Critical, direct key compromise.
      • Likelihood: Medium, especially in development or poorly configured systems.
      • Effort: Low, if keys are readily accessible.
      • Skill Level: Low.
        • 2.2.1. Storing Keys in Plaintext in Files or Databases [HIGH-RISK PATH] [CRITICAL NODE]:
          • Attack Vector: Keys are stored directly in files, configuration files, or databases without any encryption or access control.
          • Impact: Critical, keys are immediately exposed upon system compromise or unauthorized access.
          • Likelihood: Medium, a common mistake, especially in simpler applications or during development.
          • Effort: Low, attacker simply needs to access the file system or database.
          • Skill Level: Low.

Attack Tree Path: 2.1. Weak Key Generation [HIGH-RISK PATH]:

• Attack Vector: Generating keys using predictable or insufficiently random methods. * Impact: Critical, keys can be easily guessed or brute-forced. * Likelihood: Medium, especially if developers bypass libsodium's secure key generation functions. * Effort: Low, attacker can use standard cryptanalysis tools. * Skill Level: Low to Medium. * 2.1.1. Using Predictable Random Number Generators (outside libsodium's secure RNG) [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: Application uses standard, non-cryptographically secure RNGs (like rand() in C or similar in other languages) instead of libsodium's provided secure RNG functions (e.g., randombytes_buf()). * Impact: Critical, generated keys are predictable and easily compromised. * Likelihood: Medium, a common mistake for developers unfamiliar with secure cryptography. * Effort: Low, attacker can predict keys based on the weak RNG's seed or output patterns. * Skill Level: Low.

Attack Tree Path: 2.1.1. Using Predictable Random Number Generators (outside libsodium's secure RNG) [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Application uses standard, non-cryptographically secure RNGs (like rand() in C or similar in other languages) instead of libsodium's provided secure RNG functions (e.g., randombytes_buf()). * Impact: Critical, generated keys are predictable and easily compromised. * Likelihood: Medium, a common mistake for developers unfamiliar with secure cryptography. * Effort: Low, attacker can predict keys based on the weak RNG's seed or output patterns. * Skill Level: Low.

Attack Tree Path: 2.2. Insecure Key Storage [HIGH-RISK PATH]:

• Attack Vector: Storing keys in a way that is easily accessible to attackers. * Impact: Critical, direct key compromise. * Likelihood: Medium, especially in development or poorly configured systems. * Effort: Low, if keys are readily accessible. * Skill Level: Low. * 2.2.1. Storing Keys in Plaintext in Files or Databases [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: Keys are stored directly in files, configuration files, or databases without any encryption or access control. * Impact: Critical, keys are immediately exposed upon system compromise or unauthorized access. * Likelihood: Medium, a common mistake, especially in simpler applications or during development. * Effort: Low, attacker simply needs to access the file system or database. * Skill Level: Low.

Attack Tree Path: 2.2.1. Storing Keys in Plaintext in Files or Databases [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Keys are stored directly in files, configuration files, or databases without any encryption or access control. * Impact: Critical, keys are immediately exposed upon system compromise or unauthorized access. * Likelihood: Medium, a common mistake, especially in simpler applications or during development. * Effort: Low, attacker simply needs to access the file system or database. * Skill Level: Low.

Attack Tree Path: 3. Nonce/IV Reuse [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Reusing nonces (Number-Once) or Initialization Vectors (IVs) in encryption, particularly with stream ciphers or block ciphers in certain modes.

• Impact: Significant, can lead to decryption of encrypted data, message forgery, and loss of confidentiality and integrity.

• Likelihood: Medium, due to logic errors in nonce management or misunderstanding of nonce requirements.

• Effort: Medium, depending on the cipher and mode of operation.

• Skill Level: Medium.

  • 3.1. Incorrect Nonce Generation [HIGH-RISK PATH]:
    • Attack Vector: Generating nonces in a predictable or non-unique manner.
    • Impact: Significant, predictable nonces can lead to nonce reuse.
    • Likelihood: Medium, if developers don't use proper nonce generation techniques.
    • Effort: Low to Medium, depending on the predictability of the nonce generation.
    • Skill Level: Low to Medium.
      • 3.1.1. Using Predictable Nonces (e.g., sequential or time-based without sufficient entropy) [HIGH-RISK PATH] [CRITICAL NODE]:
        • Attack Vector: Nonces are generated sequentially, based on timestamps with low resolution, or using other predictable methods, instead of using cryptographically secure random nonces or counters as required for certain modes.
        • Impact: Significant, predictable nonces make nonce reuse likely, breaking encryption security.
        • Likelihood: Medium, a common mistake when developers don't fully understand nonce requirements.
        • Effort: Low, attacker can predict nonces and exploit reuse.
        • Skill Level: Low to Medium.
    • 3.2. Nonce Reuse in Encryption [HIGH-RISK PATH]:
      • Attack Vector: Accidentally or intentionally using the same nonce for multiple encryption operations with the same key.
      • Impact: Significant, especially for stream ciphers and certain block cipher modes (like CTR mode), leading to data decryption and potential forgery.
      • Likelihood: Medium, due to logic errors in application code managing nonces.
      • Effort: Medium, attacker needs to observe nonce reuse and apply cryptanalysis techniques.
      • Skill Level: Medium.
        • 3.2.1. Logic Error in Nonce Tracking/Management [HIGH-RISK PATH] [CRITICAL NODE]:
          • Attack Vector: Bugs in the application's code lead to incorrect nonce tracking, resulting in the same nonce being used multiple times for encryption with the same key.
          • Impact: Significant, nonce reuse vulnerabilities.
          • Likelihood: Medium, logic errors in complex applications are common.
          • Effort: Medium, attacker needs to identify the logic flaw and exploit the resulting nonce reuse.
          • Skill Level: Medium.

Attack Tree Path: 3.1. Incorrect Nonce Generation [HIGH-RISK PATH]:

• Attack Vector: Generating nonces in a predictable or non-unique manner. * Impact: Significant, predictable nonces can lead to nonce reuse. * Likelihood: Medium, if developers don't use proper nonce generation techniques. * Effort: Low to Medium, depending on the predictability of the nonce generation. * Skill Level: Low to Medium. * 3.1.1. Using Predictable Nonces (e.g., sequential or time-based without sufficient entropy) [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: Nonces are generated sequentially, based on timestamps with low resolution, or using other predictable methods, instead of using cryptographically secure random nonces or counters as required for certain modes. * Impact: Significant, predictable nonces make nonce reuse likely, breaking encryption security. * Likelihood: Medium, a common mistake when developers don't fully understand nonce requirements. * Effort: Low, attacker can predict nonces and exploit reuse. * Skill Level: Low to Medium.

Attack Tree Path: 3.1.1. Using Predictable Nonces (e.g., sequential or time-based without sufficient entropy) [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Nonces are generated sequentially, based on timestamps with low resolution, or using other predictable methods, instead of using cryptographically secure random nonces or counters as required for certain modes. * Impact: Significant, predictable nonces make nonce reuse likely, breaking encryption security. * Likelihood: Medium, a common mistake when developers don't fully understand nonce requirements. * Effort: Low, attacker can predict nonces and exploit reuse. * Skill Level: Low to Medium.

Attack Tree Path: 3.2. Nonce Reuse in Encryption [HIGH-RISK PATH]:

• Attack Vector: Accidentally or intentionally using the same nonce for multiple encryption operations with the same key. * Impact: Significant, especially for stream ciphers and certain block cipher modes (like CTR mode), leading to data decryption and potential forgery. * Likelihood: Medium, due to logic errors in application code managing nonces. * Effort: Medium, attacker needs to observe nonce reuse and apply cryptanalysis techniques. * Skill Level: Medium. * 3.2.1. Logic Error in Nonce Tracking/Management [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: Bugs in the application's code lead to incorrect nonce tracking, resulting in the same nonce being used multiple times for encryption with the same key. * Impact: Significant, nonce reuse vulnerabilities. * Likelihood: Medium, logic errors in complex applications are common. * Effort: Medium, attacker needs to identify the logic flaw and exploit the resulting nonce reuse. * Skill Level: Medium.

Attack Tree Path: 3.2.1. Logic Error in Nonce Tracking/Management [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Bugs in the application's code lead to incorrect nonce tracking, resulting in the same nonce being used multiple times for encryption with the same key. * Impact: Significant, nonce reuse vulnerabilities. * Likelihood: Medium, logic errors in complex applications are common. * Effort: Medium, attacker needs to identify the logic flaw and exploit the resulting nonce reuse. * Skill Level: Medium.

Attack Tree Path: 4. Incorrect Parameter Usage [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Passing incorrect parameters to libsodium functions, leading to unexpected behavior or vulnerabilities.

• Impact: Moderate to Significant, can range from denial of service to memory corruption and security bypasses.

• Likelihood: Medium, due to common programming errors and misunderstandings of API requirements.

• Effort: Low to Medium, depending on the specific parameter misuse.

• Skill Level: Low to Medium.

  • 4.1. Wrong Data Lengths [HIGH-RISK PATH]:
    • Attack Vector: Providing incorrect buffer sizes or lengths to libsodium functions.
    • Impact: Moderate to Significant, can lead to buffer overflows, underflows, or unexpected function behavior.
    • Likelihood: Medium, common programming errors related to buffer handling.
    • Effort: Low, simple coding errors.
    • Skill Level: Low.
      • 4.1.1. Passing Incorrect Buffer Sizes to Libsodium Functions [HIGH-RISK PATH] [CRITICAL NODE]:
        • Attack Vector: Application provides buffer sizes that are too small or too large for the intended operation, leading to buffer overflows or other memory-related issues within libsodium or the application.
        • Impact: Moderate to Significant, potential for denial of service, memory corruption, or unexpected behavior.
        • Likelihood: Medium, common programming errors in buffer management.
        • Effort: Low, simple coding errors.
        • Skill Level: Low.
      • 4.1.2. Mismatched Input/Output Buffer Sizes [HIGH-RISK PATH] [CRITICAL NODE]:
        • Attack Vector: Input and output buffers provided to libsodium functions have mismatched sizes, leading to data truncation, buffer overflows, or other unexpected behavior.
        • Impact: Moderate to Significant, data corruption, denial of service, or unexpected behavior.
        • Likelihood: Medium, common programming errors in buffer management.
        • Effort: Low, simple coding errors.
        • Skill Level: Low.

Attack Tree Path: 4.1. Wrong Data Lengths [HIGH-RISK PATH]:

• Attack Vector: Providing incorrect buffer sizes or lengths to libsodium functions. * Impact: Moderate to Significant, can lead to buffer overflows, underflows, or unexpected function behavior. * Likelihood: Medium, common programming errors related to buffer handling. * Effort: Low, simple coding errors. * Skill Level: Low. * 4.1.1. Passing Incorrect Buffer Sizes to Libsodium Functions [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: Application provides buffer sizes that are too small or too large for the intended operation, leading to buffer overflows or other memory-related issues within libsodium or the application. * Impact: Moderate to Significant, potential for denial of service, memory corruption, or unexpected behavior. * Likelihood: Medium, common programming errors in buffer management. * Effort: Low, simple coding errors. * Skill Level: Low. * 4.1.2. Mismatched Input/Output Buffer Sizes [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: Input and output buffers provided to libsodium functions have mismatched sizes, leading to data truncation, buffer overflows, or other unexpected behavior. * Impact: Moderate to Significant, data corruption, denial of service, or unexpected behavior. * Likelihood: Medium, common programming errors in buffer management. * Effort: Low, simple coding errors. * Skill Level: Low.

Attack Tree Path: 4.1.1. Passing Incorrect Buffer Sizes to Libsodium Functions [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Application provides buffer sizes that are too small or too large for the intended operation, leading to buffer overflows or other memory-related issues within libsodium or the application. * Impact: Moderate to Significant, potential for denial of service, memory corruption, or unexpected behavior. * Likelihood: Medium, common programming errors in buffer management. * Effort: Low, simple coding errors. * Skill Level: Low.

Attack Tree Path: 4.1.2. Mismatched Input/Output Buffer Sizes [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Input and output buffers provided to libsodium functions have mismatched sizes, leading to data truncation, buffer overflows, or other unexpected behavior. * Impact: Moderate to Significant, data corruption, denial of service, or unexpected behavior. * Likelihood: Medium, common programming errors in buffer management. * Effort: Low, simple coding errors. * Skill Level: Low.

Attack Tree Path: 5. Improper Error Handling [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Failing to properly handle errors returned by libsodium functions.

• Impact: Significant, can lead to security bypasses, authentication failures, data corruption, or unexpected program states.

• Likelihood: Medium, common programming oversight, especially in rapid development.

• Effort: Low, simple coding oversight.

• Skill Level: Low.

  • 5.1. Ignoring Return Codes from Libsodium Functions [HIGH-RISK PATH]:
    • Attack Vector: Application code does not check the return values of libsodium functions (e.g., crypto_*_VERIFY_FAIL for signature verification failures) and assumes operations are always successful.
    • Impact: Significant, security bypasses, authentication failures, data integrity issues.
    • Likelihood: Medium, common programming oversight, especially when developers are not fully aware of the importance of error handling in cryptography.
    • Effort: Low, simple coding oversight.
    • Skill Level: Low.
      • 5.1.1. Not Checking for crypto_*_VERIFY_FAIL or other error codes [HIGH-RISK PATH] [CRITICAL NODE]:
        • Attack Vector: Specifically failing to check for return codes indicating verification failures in functions like crypto_sign_verify_detached or crypto_auth_verify.
        • Impact: Significant, signature or MAC verification bypass, leading to authentication bypass or data integrity compromise.
        • Likelihood: Medium, common oversight in implementing signature or MAC verification.
        • Effort: Low, simple coding oversight.
        • Skill Level: Low.
      • 5.1.2. Assuming Success When Libsodium Function Fails [HIGH-RISK PATH] [CRITICAL NODE]:
        • Attack Vector: General failure to check return codes from any libsodium function, assuming success even when errors occur.
        • Impact: Significant, can lead to various security issues depending on the function that fails and the context.
        • Likelihood: Medium, common programming oversight.
        • Effort: Low, simple coding oversight.
        • Skill Level: Low.

Attack Tree Path: 5.1. Ignoring Return Codes from Libsodium Functions [HIGH-RISK PATH]:

• Attack Vector: Application code does not check the return values of libsodium functions (e.g., crypto_*_VERIFY_FAIL for signature verification failures) and assumes operations are always successful. * Impact: Significant, security bypasses, authentication failures, data integrity issues. * Likelihood: Medium, common programming oversight, especially when developers are not fully aware of the importance of error handling in cryptography. * Effort: Low, simple coding oversight. * Skill Level: Low. * 5.1.1. Not Checking for crypto_*_VERIFY_FAIL or other error codes [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: Specifically failing to check for return codes indicating verification failures in functions like crypto_sign_verify_detached or crypto_auth_verify. * Impact: Significant, signature or MAC verification bypass, leading to authentication bypass or data integrity compromise. * Likelihood: Medium, common oversight in implementing signature or MAC verification. * Effort: Low, simple coding oversight. * Skill Level: Low. * 5.1.2. Assuming Success When Libsodium Function Fails [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: General failure to check return codes from any libsodium function, assuming success even when errors occur. * Impact: Significant, can lead to various security issues depending on the function that fails and the context. * Likelihood: Medium, common programming oversight. * Effort: Low, simple coding oversight. * Skill Level: Low.

Attack Tree Path: 5.1.1. Not Checking for crypto_*_VERIFY_FAIL or other error codes [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Specifically failing to check for return codes indicating verification failures in functions like crypto_sign_verify_detached or crypto_auth_verify. * Impact: Significant, signature or MAC verification bypass, leading to authentication bypass or data integrity compromise. * Likelihood: Medium, common oversight in implementing signature or MAC verification. * Effort: Low, simple coding oversight. * Skill Level: Low.

Attack Tree Path: 5.1.2. Assuming Success When Libsodium Function Fails [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: General failure to check return codes from any libsodium function, assuming success even when errors occur. * Impact: Significant, can lead to various security issues depending on the function that fails and the context. * Likelihood: Medium, common programming oversight. * Effort: Low, simple coding oversight. * Skill Level: Low.

Attack Tree Path: 6. Timing Attacks on Application Logic [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Exploiting timing differences in application code to infer information about secret data, even if libsodium itself is timing-attack resistant.

• Impact: Significant, can lead to password/key recovery or information leakage.

• Likelihood: Medium, especially in authentication and authorization logic.

• Effort: Low to Medium, depending on the complexity of the timing vulnerability.

• Skill Level: Low to Medium.

  • 6.1. Timing Differences in Application Code Revealing Secret Data [HIGH-RISK PATH]:
    • Attack Vector: Application code performs operations that take variable time depending on secret data, allowing an attacker to measure these timing differences and deduce information about the secret.
    • Impact: Significant, information leakage, potential for key/password recovery.
    • Likelihood: Medium, common in poorly designed authentication or authorization mechanisms.
    • Effort: Low to Medium, depending on the vulnerability.
    • Skill Level: Low to Medium.
      • 6.1.1. String Comparison of Secrets [HIGH-RISK PATH] [CRITICAL NODE]:
        • Attack Vector: Using standard string comparison functions (like strcmp in C or == in many languages) to compare secrets (e.g., passwords, keys). These functions typically return as soon as a mismatch is found, leading to timing differences that reveal the position of mismatches and can be exploited to brute-force secrets character by character.
        • Impact: Significant, password/key recovery.
        • Likelihood: Medium, a very common mistake in authentication implementations.
        • Effort: Low, attacker can use simple timing attack techniques.
        • Skill Level: Low.

Attack Tree Path: 6.1. Timing Differences in Application Code Revealing Secret Data [HIGH-RISK PATH]:

• Attack Vector: Application code performs operations that take variable time depending on secret data, allowing an attacker to measure these timing differences and deduce information about the secret. * Impact: Significant, information leakage, potential for key/password recovery. * Likelihood: Medium, common in poorly designed authentication or authorization mechanisms. * Effort: Low to Medium, depending on the vulnerability. * Skill Level: Low to Medium. * 6.1.1. String Comparison of Secrets [HIGH-RISK PATH] [CRITICAL NODE]: * Attack Vector: Using standard string comparison functions (like strcmp in C or == in many languages) to compare secrets (e.g., passwords, keys). These functions typically return as soon as a mismatch is found, leading to timing differences that reveal the position of mismatches and can be exploited to brute-force secrets character by character. * Impact: Significant, password/key recovery. * Likelihood: Medium, a very common mistake in authentication implementations. * Effort: Low, attacker can use simple timing attack techniques. * Skill Level: Low.

Attack Tree Path: 6.1.1. String Comparison of Secrets [HIGH-RISK PATH] [CRITICAL NODE]:

• Attack Vector: Using standard string comparison functions (like strcmp in C or == in many languages) to compare secrets (e.g., passwords, keys). These functions typically return as soon as a mismatch is found, leading to timing differences that reveal the position of mismatches and can be exploited to brute-force secrets character by character. * Impact: Significant, password/key recovery. * Likelihood: Medium, a very common mistake in authentication implementations. * Effort: Low, attacker can use simple timing attack techniques. * Skill Level: Low.