constant-time-analysis

npx skills add trailofbits/skills --skill constant-time-analysis --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

# Constant-Time Analysis Compile the code, inspect the emitted assembly or bytecode for variable-time instructions, then decide which of the flagged operations actually touch secrets. The compilation step is mechanical; the triage step is the work. ## When to Use - Implementing or reviewing a signature, encryption, KEM, or key derivation routine - Code applies `/` or `%` to a value derived from a key, plaintext, nonce, or token - The user mentions "constant-time", "timing attack", "side-channel", or "KyberSlash" - Reviewing functions named `sign`, `verify`, `encrypt`, `decrypt`, `derive_key` ## When NOT to Use - **Measuring** timing variance on a running binary — use the `constant-time-testing` skill from the `testing-handbook-skills` plugin, which covers dudect and statistical approaches and may not be installed. This skill inspects compiler output statically and never executes the code under test. - Non-cryptographic code, or crypto code where every input is public - High-level API usage where a vetted library owns the constant-time guarantees - Cache and other microarchitectural side channels — the assembly view cannot see them ## Language Routing Read the guide for the target l

uv run {baseDir}/ct_analyzer/analyzer.py --warnings <source_file>
for f in src/crypto/*.c; do uv run {baseDir}/ct_analyzer/analyzer.py --warnings --json "$f"; done