Constant-Time Analysis

Constant-Time Analysis

Compile the code, inspect the emitted assembly or bytecode for variable-time instructions, then decide which of the flagged operations actually touch secrets. The compilation step is mechanical; the triage step is the work.

When to Use

• Implementing or reviewing a signature, encryption, KEM, or key derivation routine
• Code applies / or % to a value derived from a key, plaintext, nonce, or token
• The user mentions "constant-time", "timing attack", "side-channel", or "KyberSlash"
• Reviewing functions named sign, verify, encrypt, decrypt, derive_key

When NOT to Use

• Measuring timing variance on a running binary — use the constant-time-testing skill from the testing-handbook-skills plugin, which covers dudect and statistical approaches and may not be installed. This skill inspects compiler output statically and never executes the code under test.
• Non-cryptographic code, or crypto code where every input is public
• High-level API usage where a vetted library owns the constant-time guarantees
• Cache and other microarchitectural side channels — the assembly view cannot see them

Language Routing

Read the guide for the target language before interpreting any findings; each one lists that language's dangerous instructions and the idiomatic constant-time replacements.

Running the Analyzer

The analyzer takes one file and detects the language from its extension. Always pass --warnings:

uv run {baseDir}/ct_analyzer/analyzer.py --warnings <source_file>