# constant-time-analysis

Inspects compiled assembly and bytecode for timing side-channels. It flags secret-dependent branches and variable-time operations in crypto routines.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 5400 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/constant-time-analysis

## What it does

This skill compiles a source file and inspects the resulting assembly or bytecode for variable-time instructions. It flags secret division, modulo operations, and secret-dependent branches. It is purely static analysis. The tool does not execute binaries or take runtime timing measurements.

The analysis runs through `ct_analyzer/analyzer.py` using `uv`. It detects languages by file extension across C, C++, Rust, Go, Swift, Java, C#, PHP, JavaScript, Python, and Ruby. For native binaries, you can pass `--arch`, `--compiler`, and `--opt-level` to inspect different optimization passes.

Running without `--warnings` leaves common timing leaks invisible. Without this flag, early-exit comparisons like `memcmp` and secret table lookups stay silent. A clean report on `-O2` does not prove safety on `-O0`, where compiler transforms can restore variable-time branches.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-analysis -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/constant-time-analysis/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/constant-time-analysis/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-analysis -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/constant-time-analysis/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-analysis -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/constant-time-analysis/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills constant-time-analysis
```

2. **Manually: put the files in place**
- File: `.github/skills/constant-time-analysis/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-analysis -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/constant-time-analysis/skills/constant-time-analysis
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/constant-time-analysis/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-analysis -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md

## When to use it
- spot division or modulo instructions operating on secret inputs
- catch early-exit comparisons like memcmp in authentication tags
- audit compiler assembly across multiple architectures and optimization levels
- identify secret-dependent branches before deploying cryptographic routines

## Example prompts
- Run constant-time analysis on crypto/sign.c targeting arm64 with --warnings.
- Check src/kem.rs for variable-time branches and secret division.
- Audit the verify routine in auth_tag.py for early-exit comparisons.

## Similar
- [malware-analysis-dragonflyTomb-avast](https://affpapa.org/en/nevibecode/skills/malware-analysis-dragonflytomb-avast.md) — skill · 1000 installs
- [static-analysis](https://affpapa.org/en/nevibecode/skills/static-analysis.md) — skill · 1200 installs
- [crypto-audit](https://affpapa.org/en/nevibecode/skills/crypto-audit.md) — skill · 353 installs
- [skill-scanner](https://affpapa.org/en/nevibecode/skills/skill-scanner.md) — skill · 3800 installs
- [code-review-pro](https://affpapa.org/en/nevibecode/skills/code-review-pro.md) — skill · 2600 installs
- [semgrep](https://affpapa.org/en/nevibecode/skills/semgrep-semgrep.md) — skill · 2200 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md