What tools does this skill help me implement?

This skill provides workflows for statistical tools like dudect, dynamic analysis tools like Timecop (Valgrind), and formal verification frameworks like SideTrail and ct-verif.

What are common code patterns that cause timing leaks?

The most frequent culprits are conditional jumps (if/while) based on secrets, array indexing using secret values (cache-timing), and certain processor-dependent operations like integer division.

What is a timing side-channel attack?

A timing attack is a security exploit where an attacker extracts secret information, such as private keys or passwords, by analyzing the time it takes for a cryptographic algorithm to execute on different inputs.

Can I use this skill for non-cryptographic performance testing?

While the principles of timing measurement are similar, this skill specifically focuses on the security implications of timing differences in relation to secret data rather than general performance optimization.

When should I use the Constant-Time Testing skill?

Apply this skill whenever you are auditing cryptographic implementations, handling secret keys, reviewing PRs that touch sensitive crypto code, or implementing algorithms from scratch.

Constant-Time Crypto Testing

Name: Constant-Time Crypto Testing
Author: fjor1025

byfjor1025

0•

セキュリティとテスト

Detects and remediates timing side-channel vulnerabilities in cryptographic implementations to prevent secret data leakage.

This skill provides comprehensive guidance for auditing cryptographic code to ensure execution time remains independent of secret data. It helps developers and security researchers identify common timing violation patterns—such as conditional jumps and secret-dependent memory accesses—while offering structured workflows for statistical analysis using dudect and dynamic tracing with Timecop. By implementing the provided best practices, teams can harden their security primitives against sophisticated side-channel attacks that exploit microarchitectural execution differences.

主な機能

01Offers guidance on formal verification and symbolic execution for high-assurance security audits

02Integrates statistical analysis workflows using dudect for real-world timing measurement

030 GitHub stars

04Identifies timing side-channel vulnerabilities in RSA, AES, and post-quantum algorithms

05Provides implementation patterns for constant-time code to avoid conditional branching

06Facilitates root-cause analysis through dynamic tracing and memory poisoning with Timecop

ユースケース

01Integrating automated timing side-channel detection into CI/CD pipelines

02Implementing constant-time modular exponentiation for RSA or Diffie-Hellman

03Auditing cryptographic libraries for timing leaks during security reviews

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add fjor1025/infosec-framework constant-time-testing

For use in Claude.ai and ChatGPT

Download Skill