constant-time-testing

Detect timing leaks in cryptographic code by measuring execution time with secret inputs across libraries and architectures. This Skill identifies leak patterns in modular exponentiation, AES, and related primitives using statistical, dynamic, and formal analysis techniques.

Constant-time testing is a security-testing technique that identifies timing side channels in cryptographic code. By measuring execution time variations with different secret inputs, it detects vulnerabilities that could leak sensitive information to attackers.

Use dudect as a statistical tool within a phased constant-time analysis workflow to measure execution time variations in your cryptographic functions. This Skill guides you through applying dudect alongside dynamic and formal tools to detect timing leaks accurately.

Constant-time testing works directly with AES and modular exponentiation implementations across various libraries and architectures. The Skill specifically targets these primitives to identify timing leak patterns and provides remediation guidance for secure coding.

Fix timing leaks by following the remediation guidance provided after identifying them through statistical, dynamic, and formal analysis. The Skill supports a phased workflow that includes interpreting test results and applying secure coding practices to eliminate side channels.

Combine Timecop, dudect, and ct-verif through a phased constant-time analysis workflow that leverages dynamic, statistical, and formal techniques respectively. This approach ensures comprehensive timing leak detection across cryptographic implementations and architectures.