domains / families / security / constant-time-analysis

constant-time-analysis

combined

Analyze cryptographic code to detect operations that leak secret data through execution timing variations. Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

When to use

• User implements signature, encryption, or key derivation
• Code contains `/` or `%` operators on secret-derived values
• User mentions "constant-time", "timing attack", "side-channel", "KyberSlash"
• Reviewing functions named `sign`, `verify`, `encrypt`, `decrypt`, `derive_key`
• Implementing or reviewing a signature, encryption, KEM, or key derivation routine
• Code applies `/` or `%` to a value derived from a key, plaintext, nonce, or token
• The user mentions "constant-time", "timing attack", "side-channel", or "KyberSlash"

When not to use

• Non-cryptographic code (business logic, UI, etc.)
• Public data processing where timing leaks don't matter
• Code that doesn't handle secrets, keys, or authentication tokens
• High-level API usage where timing is handled by the library
• **Static Analysis Only**: Analyzes assembly/bytecode, not runtime behavior. Cannot detect cache timing or microarchitectural side-channels.
• **No Data Flow Analysis**: Flags all dangerous operations regardless of whether they process secrets. Manual review required.
• **Compiler/Runtime Variations**: Different compilers, optimization levels, and runtime versions may produce different output.
• **Measuring** timing variance on a running binary — use the `constant-time-testing` skill from the `testing-handbook-skills` plugin, which covers dudect and statistical approaches and may not be installed. This skill inspects compiler outp…

Skill page

Conflict

The trailofbits copy is the more complete and authoritative procedure, but the sickn33 copy adds material constraints and setup steps that the first lacks, so crowning one would hide a real alternative. The trailofbits copy mandates --warnings, explains why the default run is quiet about the most common bug, and gives detailed cross-architecture/optimization-level guidance including a table of when strength reduction fails. The sickn33 copy adds a prerequisites table, macOS PATH setup for keg-only Java/.NET, and a decision flowchart, but it presents --warnings as optional and omits the critical warning about default runs missing early-exit comparisons. These are complementary, not merely redundant.