# constant-time-testing

This skill helps test whether a cryptographic implementation’s runtime varies with secret data. Use it when auditing crypto code or investigating a possible timing leak.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 5200 installs · ★ 7805
- Author: trailofbits
- License: CC-BY-SA-4.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/trailofbits/skills/tree/HEAD/plugins/testing-handbook-skills/skills/constant-time-testing/SKILL.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/skills/constant-time-testing

## What it does

The skill focuses on measurements from running cryptographic code. It covers statistical timing tests and runtime tracing, then explains how formal, symbolic, dynamic, and statistical approaches differ. This is execution-time analysis, not a static inspection of compiler output.

The guide discusses branches driven by secrets, array lookups, division, and shifts as potential sources of timing variation. Statistical results can be affected by noise and do not identify the cause on their own, so interpretation matters. The material is aimed at cryptographic code that handles secret values.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-testing -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/constant-time-testing/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/constant-time-testing/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-testing -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/constant-time-testing/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-testing -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/constant-time-testing/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install trailofbits/skills constant-time-testing
```

2. **Manually: put the files in place**
- File: `.github/skills/constant-time-testing/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-testing -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/trailofbits/skills --path plugins/testing-handbook-skills/skills/constant-time-testing
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/constant-time-testing/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add trailofbits/skills --skill constant-time-testing -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/trailofbits/skills/tree/HEAD/plugins/testing-handbook-skills/skills/constant-time-testing/SKILL.md

## When to use it
- test whether runtime varies with secret inputs
- measure timing variation in a compiled crypto binary
- investigate a suspected timing leak in cryptographic code
- interpret results from runtime or statistical analysis

## Example prompts
- Check whether this cryptographic implementation’s runtime depends on its secret key.
- Measure timing variation in the compiled version of this cryptographic function.
- Investigate whether a branch on secret data could reveal information through runtime differences.

## Similar
- [improve-codebase-architecture](https://affpapa.org/en/nevibecode/skills/improve-codebase-architecture.md) — skill · 1163035 installs
- [design-taste-frontend](https://affpapa.org/en/nevibecode/skills/design-taste-frontend.md) — skill · 678700 installs
- [tdd](https://affpapa.org/en/nevibecode/skills/tdd.md) — skill · 1141062 installs
- [skill-creator](https://affpapa.org/en/nevibecode/skills/skill-creator.md) — skill · 414180 installs
- [agent-browser](https://affpapa.org/en/nevibecode/skills/vercel-labs-agent-browser.md) — skill · 1200000 installs
- [prototype](https://affpapa.org/en/nevibecode/skills/prototype.md) — skill · 986201 installs

From the same set: [trailofbits/skills](https://affpapa.org/en/nevibecode/by/trailofbits/skills.md) — 77 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md