Can this skill detect cache-timing attacks?

This skill focuses on instruction-level timing variations (like division and branching); it does not currently detect cache-timing or microarchitectural side-channels.

Which programming languages are supported by this skill?

The skill supports a wide range of languages including C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, and Ruby.

Why is it necessary to analyze the assembly for compiled languages?

Compilers often optimize code in ways that break constant-time guarantees written in high-level source; this tool analyzes the final assembly to ensure security is maintained after compilation.

Does it perform automated data flow analysis?

No, the tool performs static analysis on assembly/bytecode and flags all potentially dangerous operations. Developers must manually verify if flagged operations involve secret data.

Constant-Time Analysis

Name: Constant-Time Analysis
Author: fjor1025

byfjor1025

0•

보안 및 테스팅

Analyzes cryptographic code to identify and mitigate timing side-channel vulnerabilities across multiple programming languages.

The Constant-Time Analysis skill is a specialized security tool designed to harden cryptographic implementations by detecting operations that leak sensitive data through execution timing variations. By examining assembly or bytecode, it identifies high-risk patterns such as secret-dependent branching, division operations on secret values, and non-constant-time comparisons. This skill is essential for developers implementing encryption, digital signatures, or key derivation functions, providing automated audits to prevent sophisticated attacks like KyberSlash or Lucky Thirteen while offering language-specific guidance for remediation.

주요 기능

01Cross-architecture testing capabilities for x86_64 and ARM64

02Identification of secret-dependent branches and dangerous division operations

030 GitHub stars

04Automated triage reporting with support for JSON output in CI/CD pipelines

05Assembly and bytecode-level analysis for precise instruction detection

06Multi-language support for C, Rust, Go, Java, Swift, Python, and more

사용 사례

01Verifying that compiler optimizations haven't introduced side-channel vulnerabilities

02Auditing custom encryption and digital signature implementations for timing leaks

03Reviewing post-quantum cryptographic code for division-related timing issues

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add fjor1025/infosec-framework constant-time-analysis

For use in Claude.ai and ChatGPT

Download Skill