constant-time-testing

SKILL.md

Constant-Time Testing

Timing attacks exploit variations in execution time to extract secret information from cryptographic implementations. Unlike cryptanalysis that targets theoretical weaknesses, timing attacks leverage implementation flaws - and they can affect any cryptographic code.

Background

Timing attacks were introduced by Kocher in 1996. Since then, researchers have demonstrated practical attacks on RSA (Schindler), OpenSSL (Brumley and Boneh), AES implementations, and even post-quantum algorithms like Kyber.

Key Concepts

Concept
Description

Constant-time
Code path and memory accesses independent of secret data

Timing leakage
Observable execution time differences correlated with secrets

Side channel
Information extracted from implementation rather than algorithm

Microarchitecture
CPU-level timing differences (cache, division, shifts)

Why This Matters