skills.rest
TECH-HY
TECH-HYOFFICIAL
Explore all skills by this author →
GitHub

constant-time-analysis

Detects timing side-channel vulnerabilities in cryptographic code by analyzing assembly and bytecode output.

Updated Mar 22, 2026
Search Tags:#static analysis#security audit#cryptography#bytecode#constant-time#timing attack#side-channel
One-click install
npx skills add https://github.com/TECH-HY/SKILLS --skill constant-time-analysis-tech-hy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: constant-time-analysis
Source: https://github.com/TECH-HY/SKILLS/tree/main/skills/constant-time-analysis
Command: npx skills add https://github.com/TECH-HY/SKILLS --skill constant-time-analysis-tech-hy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Cryptographic code can leak secret keys through timing variations caused by division instructions, secret-dependent branches, and early-exit comparisons. Manually auditing compiled output across languages and architectures is tedious and error-prone, and real-world attacks like KyberSlash exploited exactly these leaks. ## Core Features & Use Cases - Multi-language analysis: Scans C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby by inspecting generated assembly or bytecode for variable-time instructions like DIV, SDIV, and FDIV. - Cross-architecture testing: Tests compiled output for x86_64, ARM64, RISC-V, PowerPC, and other targets at multiple optimization levels, since compilers make different decisions per target. - CI-ready output: Produces JSON reports with function-level violation details suitable for automated pipelines, plus guidance on fixes like Barrett reduction and constant-time selection. - Use Case: While implementing an ML-KEM signing function in C, run the analyzer with --arch arm64 to confirm no SDIV instructions appear in the compiled output before merging. ## Quick Start Ask the AI to check your cryptographic source file for timing vulnerabilities using the constant-time analyzer, for example by requesting a scan of crypto.c across x86_64 and arm64 architectures.

Frequently Asked Questions about constant-time-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check C code for timing side-channel vulnerabilities?▼

Run the analyzer on your source file to compile it and scan the assembly for dangerous instructions like DIV and IDIV. Use --arch to test multiple architectures and --opt-level to compare O0 versus O3 output, since compilers generate different code per setting.

How to detect timing attacks in Python cryptographic code?▼

The analyzer uses Python's dis module to inspect CPython bytecode for BINARY_TRUE_DIVIDE, BINARY_MODULO, and similar variable-time operations. It also flags predictable functions like random.randint, recommending secrets.randbelow and hmac.compare_digest instead.

Does constant-time analysis work for Java and Kotlin?▼

Yes, Java and Kotlin are analyzed at the JVM bytecode level using javap, detecting idiv, ldiv, and conditional branch instructions. The --arch and --opt-level flags do not apply since bytecode runs on a JIT-compiling virtual machine.

Why does the analyzer flag division that is not a vulnerability?▼

The tool performs static analysis without data flow tracking, so it flags all dangerous instructions regardless of whether they process secrets. Division on public values like lengths is a false positive; trace each flagged operand back to secret inputs to confirm.

What are the limitations of static timing analysis?▼

Static analysis cannot detect cache timing, microarchitectural attacks like Spectre, or runtime JIT behavior. It also cannot determine whether flagged operations actually handle secret data, so manual review of each finding is required.

How do I fix a division timing vulnerability in crypto code?▼

Replace division with Barrett reduction by precomputing mu equals 2^32 divided by the divisor, then computing the quotient via multiplication and shift. For branches on secrets, use constant-time selection with bit masking instead of if-else.

Related Skills

Explore More Software Engineering Skills→
StuartF303StuartF303

cryptography

Sign, verify, encrypt, and derive HD wallets across multiple cryptographic algorithms.

Community
Advanced
SensLiaoSensLiao

security-remediation

Automate security finding remediation with regression tests and evidence generation.

Community
Advanced
iiammaeiiammae

constant-time-analysis

Detect timing side-channel vulnerabilities in cryptographic code across languages and architectures.

Community
Advanced
dakshrawat298-gifdakshrawat298-gif

constant-time-testing

Audit cryptographic implementations for timing side-channel leaks using dudect and timecop.

Community
Advanced