constant-time-analysis
Detects timing side-channel vulnerabilities in cryptographic code across 12 languages.
- Analyzes assembly or bytecode to flag variable-time operations (division, secret-dependent branches, weak RNG, table lookups by secret index) that leak secret data through execution timing
- Supports C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby with language-specific analysis guides
- Offers cross-architecture and optimization-level testing for compiled languages to catch compiler-dependent timing leaks
- Requires manual data-flow verification for each flagged operation; static analysis flags all potentially dangerous instructions regardless of secret involvement
Constant-Time Analysis
Analyze cryptographic code to detect operations that leak secret data through execution timing variations.
When to Use
More from trailofbits/skills
ask-questions-if-underspecified
Clarify requirements before implementing. Use when serious doubts arise.
4.4Ksemgrep
>-
4.0Kmodern-python
Configures Python projects with modern tooling (uv, ruff, ty). Use when creating projects, writing standalone scripts, or migrating from pip/Poetry/mypy/black.
3.9Kcodeql
>-
3.8Kinsecure-defaults
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
3.7Ksecure-workflow-guide
Guides through Trail of Bits' 5-step secure development workflow. Runs Slither scans, checks special features (upgradeability/ERC conformance/token integration), generates visual security diagrams, helps document security properties for fuzzing/verification, and reviews manual security areas.
3.6K