constant-time-analysis

Analyzes cryptographic code for timing side-channel vulnerabilities across multiple languages.

1|Updated Dec 30, 2025

Search Tags:#security #cryptography #vulnerability analysis #constant-time #timing attack #side-channel

Ready to run

npx skills add https://github.com/statick88/dotfiles --skill constant-time-analysis-statick88

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: constant-time-analysis
Source: https://github.com/statick88/dotfiles/tree/main/amp/.agents/skills/constant-time-analysis
Command: npx skills add https://github.com/statick88/dotfiles --skill constant-time-analysis-statick88

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill safeguards cryptographic code by detecting and helping to fix operations that leak secret data through execution timing variations, preventing sophisticated timing side-channel attacks.

Core Features & Use Cases

Vulnerability Detection: Identifies dangerous instructions (division, branches) in code that depend on secret values.
Language Support: Analyzes code written in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby.
Use Case: When implementing a new encryption algorithm or reviewing existing code that handles private keys, use this Skill to ensure no timing leaks are introduced that could compromise the security of your system.

Quick Start

Use the constant-time-analysis skill to analyze the file 'crypto.c' for timing vulnerabilities.

Frequently Asked Questions about constant-time-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect timing side-channel vulnerabilities in cryptographic code?▼

Timing side-channel vulnerabilities in cryptographic code are detected by analyzing compiled assembly or bytecode for dangerous instructions like division on secrets, secret-dependent branches, and non-constant-time comparisons across multiple programming languages.

What programming languages are supported for constant-time analysis?▼

Constant-time analysis supports compiled languages including C, C++, Go, Rust, and Swift by examining assembly, plus VM-compiled languages like Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby by examining bytecode.

When do I need to analyze code for timing attacks?▼

You need to analyze code for timing attacks when implementing new encryption algorithms or reviewing existing code that handles private keys, ensuring no execution timing variations leak secret data and compromise system security.

How do I check my C code for secret-dependent branches that cause timing leaks?▼

To check C code for secret-dependent branches causing timing leaks, analyze the compiled assembly output to identify operations where execution paths or instructions vary based on secret values.

Does constant-time analysis work with both compiled and VM-compiled languages?▼

Constant-time analysis works with both compiled and VM-compiled languages by examining the generated assembly for compiled code like Rust and Swift, and inspecting the bytecode for VM-compiled code like Java and Python.

What types of operations leak secret data through execution timing variations?▼

Operations that leak secret data through execution timing variations include division on secret values, secret-dependent branches, and non-constant-time comparisons, which can be exploited in sophisticated timing side-channel attacks.