constant-time-analysis

What this skill does

Inspects cryptographic source code for timing side-channel vulnerabilities — flaws that allow an attacker to infer secret values by measuring how long operations take. Targets secret-dependent control flow (branches, early returns), variable-time memory accesses (table lookups indexed by secret bytes), and missing or broken constant-time comparison primitives. Combines grep-based static analysis with optional dynamic instrumentation via ctgrind, timecop, or dudect, and maps confirmed findings to MITRE ATT&CK techniques.

When to use

• Auditing AES, RSA, ECDSA, HMAC, or password-comparison routines for timing leaks
• Reviewing a custom crypto library or a vendor patch that touches sensitive comparison logic
• Verifying that a memcmp replacement is truly constant-time before production use
• Checking that compiler flags (-O2, LTO, PGO) have not optimized away carefully written constant-time code
• Satisfying a security requirement that mandates constant-time operations for key material handling

Prerequisites