Why is constant-time programming important?

If code execution time depends on secret values, attackers can use high-precision timers to recover sensitive data like encryption keys or passwords.

Does it support CI/CD integration?

Yes, it can produce JSON output, allowing it to be integrated into automated security pipelines to catch timing leaks before deployment.

What languages does this skill support?

It supports 14 major languages including C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby.

Can it distinguish between public and secret data automatically?

No, it flags all potentially dangerous operations. Developers must manually verify if the flagged operation's input depends on secret data like private keys.

How does it detect vulnerabilities?

The skill performs static analysis on assembly or bytecode to find instructions (like division or conditional jumps) whose execution time varies based on operand values.

Constant-Time Cryptography Analysis

Name: Constant-Time Cryptography Analysis
Author: monmacllcapp

bymonmacllcapp

0•

セキュリティとテスト

Detects timing side-channel vulnerabilities and secret-dependent operations in cryptographic code across 14+ programming languages.

This skill empowers developers to identify and mitigate timing side-channel attacks by analyzing assembly and bytecode for instructions that leak sensitive data. It automatically flags dangerous operations like secret-dependent branches, divisions, and early-exit comparisons in popular languages including C, Rust, Go, and Java. By providing architectural-specific analysis and optimization-level checks, it helps ensure that cryptographic implementations remain constant-time, protecting against real-world threats like KyberSlash and RSA timing attacks. It serves as a critical auditing layer for any code handling private keys, encryption, or authentication tokens.

主な機能

01Assembly and bytecode-level analysis to detect low-level timing variations

02Optimization-level auditing to identify compiler-introduced side-channels

03Targeted function filtering and JSON output for CI/CD integration

04Cross-architecture testing for x86_64 and arm64 platforms

05Multi-language support for 14+ languages including C, Rust, Go, Swift, and Java

060 GitHub stars

ユースケース

01Auditing cryptographic implementations (sign, verify, encrypt) for timing leaks

02Identifying secret-dependent branching or division operations in security-sensitive code

03Verifying constant-time properties across different CPU architectures and compiler flags

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add monmacllcapp/skill-forks constant-time-analysis

For use in Claude.ai and ChatGPT

Download Skill