constant-time-analysis

Constant-Time Analysis

Analyze cryptographic code to detect operations that leak secret data through execution timing variations.

Companion analyzer: The upstream Trail of Bits prodsec-skills constant-time-analysis plugin ships ct_analyzer/analyzer.py and per-language reference docs (see upstream Trail of Bits prodsec-skills for companion files).

When to Use

User writing crypto code? ──yes──> Use this skill
         │
         no
         │
         v
User asking about timing attacks? ──yes──> Use this skill
         │
         no
         │
         v
Code handles secret keys/tokens? ──yes──> Use this skill
         │
         no
         │
         v
Skip this skill

Concrete triggers:

• User implements signature, encryption, or key derivation
• Code contains / or % operators on secret-derived values
• User mentions "constant-time", "timing attack", "side-channel", "KyberSlash"
• Reviewing functions named sign, verify, encrypt, decrypt, derive_key

When NOT to Use

• Non-cryptographic code (business logic, UI, etc.)
• Public data processing where timing leaks don't matter
• Code that doesn't handle secrets, keys, or authentication tokens
• High-level API usage where timing is handled by the library

Language Selection

Based on the file extension or language context, use the matching upstream reference under plugins/constant-time-analysis/skills/constant-time-analysis/references/:

Language	File Extensions	Guide (upstream filename)
C, C++	.c, .h, .cpp, .cc, .hpp	compiled.md
Go	.go	compiled.md
Rust	.rs	compiled.md
Swift	.swift	swift.md
Java	.java	vm-compiled.md
Kotlin	.kt, .kts	kotlin.md
C#	.cs	vm-compiled.md
PHP	.php	php.md
JavaScript	.js, .mjs, .cjs	javascript.md
TypeScript	.ts, .tsx	javascript.md
Python	.py	python.md
Ruby	.rb	ruby.md