Which tools does this skill help me use?

The skill provides implementation guidance for statistical tools like dudect, dynamic analysis tools like Timecop (Valgrind), and formal verification tools like ct-verif.

When should I apply constant-time analysis?

Apply it whenever you are auditing or writing code that handles private keys, exponents, nonces, password hashes, or any sensitive cryptographic material.

What is constant-time testing?

It is a security analysis method used to ensure that the execution time of cryptographic code does not vary based on secret data, preventing timing side-channel attacks.

Why are conditional jumps dangerous in cryptographic code?

Conditional jumps based on secret data create different execution paths with varying timings, which attackers can observe to reconstruct secret keys or passwords.

Can this skill help with cache-timing attacks?

Yes, it provides patterns and diagnostic tools to identify secret-dependent array accesses, which are the primary cause of cache-timing vulnerabilities.

Constant-Time Cryptography Testing

Name: Constant-Time Cryptography Testing
Author: monmacllcapp

bymonmacllcapp

0•

セキュリティとテスト

Detects and remediates timing side-channel vulnerabilities in cryptographic implementations to prevent secret data leakage.

This skill provides specialized guidance for auditing cryptographic code for timing attacks, which exploit execution time variations to extract secrets like private keys. It offers a structured workflow—from initial statistical assessment using tools like dudect to root-cause analysis with dynamic tracing via Timecop—enabling developers to identify and fix common violation patterns such as conditional branching on secrets or cache-timing leaks from array accesses. It is an essential resource for security engineers and developers building high-assurance cryptographic primitives or protocols where maintaining constant-time execution is critical for security.

主な機能

01Statistical leakage detection guidance using dudect and Welch's t-test

02Identification of timing side-channel patterns in code and assembly

03Dynamic tracing workflows with Timecop and Valgrind for root-cause analysis

04Integration patterns for formal verification tools like ct-verif and SideTrail

050 GitHub stars

06Remediation strategies for conditional jumps and cache-timing vulnerabilities

ユースケース

01Reviewing pull requests involving sensitive key handling or password hashing

02Auditing custom cryptographic primitives for timing vulnerabilities

03Integrating automated constant-time checks into security CI/CD pipelines

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add monmacllcapp/skill-forks constant-time-testing

For use in Claude.ai and ChatGPT

Download Skill