Constant-Time Analysis

When to Use

• Reviewing code that compares secrets (tokens, passwords, MACs, signatures)
• Auditing cryptographic implementations for timing leaks
• Checking authentication or authorization code for side-channel risks
• Verifying that branching doesn't depend on secret values
• Analyzing code paths that process sensitive data with variable timing

When NOT to Use

• Non-security-sensitive comparisons (public data)
• Performance optimization (different goal)
• General code review without cryptographic context

Why Timing Matters

Non-constant-time string comparison reveals information bit by bit: