constant-time-analysis

SKILL.md

Constant-Time Analysis

Compile the code, inspect the emitted assembly or bytecode for variable-time instructions, then decide which of the flagged operations actually touch secrets. The compilation step is mechanical; the triage step is the work.

When to Use

Implementing or reviewing a signature, encryption, KEM, or key derivation routine

Code applies / or % to a value derived from a key, plaintext, nonce, or token

The user mentions "constant-time", "timing attack", "side-channel", or "KyberSlash"

Reviewing functions named sign, verify, encrypt, decrypt, derive_key

When NOT to Use

Measuring timing variance on a running binary — use the constant-time-testing skill from the testing-handbook-skills plugin, which covers dudect and statistical approaches and may not be installed. This skill inspects compiler output statically and never executes the code under test.

Non-cryptographic code, or crypto code where every input is public

High-level API usage where a vetted library owns the constant-time guarantees

Cache and other microarchitectural side channels — the assembly view cannot see them

Language Routing