constant-time-analysis

Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

5,355stars472forksUpdated 5/24/2026

Data Science & ML Security Code Review #security #c++#constant-time #cryptography #rust #java #code-review #python #javascript #side-channel

Security Assessment

Critical Risk(0/100)

Detected risks:

Persistence([references/vm-compiled.md] .zshrc, [references/vm-compiled.md] .bashrc, [SKILL.md] .zshrc)

Remote Code Execution([references/javascript.md] eval(, [references/python.md] eval(, [references/python.md] exec()

Secret Exposure([references/kotlin.md] token =, [references/php.md] token =, [references/javascript.md] Token =)

Privilege Escalation([references/kotlin.md] sudo, [references/php.md] sudo, [references/vm-compiled.md] sudo)

Security Score0/100

About constant-time-analysis

The 'constant-time-analysis' skill is designed to detect timing side-channel vulnerabilities in cryptographic code. It analyzes code to identify operations that may leak secret data through execution time variations, such as divisions on secret-derived values or secret-dependent branches. This is crucial for developers and security auditors who need to ensure that cryptographic implementations remain resistant to timing attacks, a common form of side-channel attack where an attacker infers sensitive information by measuring how long certain computations take.

The skill supports a wide range of programming languages including C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby. It offers several features to streamline the analysis: detecting operations on secret data, warning about conditional branches, filtering analysis to specific functions (e.g., 'sign', 'verify', 'encrypt', 'decrypt', 'derive_key'), and outputting results in JSON for CI/CD integration. Additionally, it allows cross-architecture testing and optimization-level analysis for native compiled languages and supports bytecode analysis for VM-compiled languages.

This skill is particularly useful for developers implementing cryptographic primitives, reviewing code that handles secret keys or tokens, or evaluating applications for timing-based vulnerabilities. Target users include software engineers, security auditors, and cryptography researchers who need a reliable tool to enforce constant-time programming practices and reduce the risk of side-channel leaks in both open-source and proprietary codebases.

FAQ

Which programming languages are supported by the constant-time-analysis skill?

It supports C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby. The analysis process adapts to whether the language is natively compiled or VM-compiled.

When should I use this skill?

Use it when writing or reviewing cryptographic code, when code handles secret keys or tokens, or when a user mentions terms like 'constant-time', 'timing attack', or 'side-channel'. It is also recommended if your code uses operators like '/' or '%' on secret-derived values.

Can this skill be used on non-cryptographic code?

No, it is not intended for non-cryptographic code, public data processing, or high-level API usage where timing attacks are not a concern.

Does the skill support JSON output for integration?

Yes, it can produce JSON-formatted output suitable for CI/CD pipelines to facilitate automated testing and reporting.

Are cross-architecture tests supported?

Yes, for native compiled languages (C, C++, Go, Rust), you can run the analysis across different CPU architectures and optimization levels to detect potential timing vulnerabilities.