Menu

Individual skill

constant-time-analysis

Use when reviewing cryptographic code for timing side-channels, statically in compiled output or at runtime with statistical timing tests. Not for known-answer vectors: use wycheproof.

.devin/skills/constant-time-analysis/SKILL.md

Read pinned source

Source commit b0e8ce89a19fac880251dc3ea1babfeb4503a4fe

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
Yes
Repository scan complete
No
Skill scan complete
No
Observed behavior
Instructions only
Last checked
Nov 4, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
55
Repository last updated
Sep 28, 2026
License
Apache-2.0

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

# Constant-time analysis

## Contract

| Field | Bound contract |
|---|---|
| Trigger | User needs static inspection of compiled assembly or VM bytecode for secret-dependent variable-time operations, or runtime and statistical evidence that a cryptographic implementation leaks timing information. |
| Authority | Reversible local: static mode is read-only and produces only local intermediate compiler output, discarded after analysis; runtime mode writes only a timing-test harness, its compiled binary, and measured sample files under a scratch directory, and rollback is deleting the scratch directory and compiled artifacts. The implementation under test is read and compiled but never edited. No remote mutation. |
| Side effect | A compiler or bytecode analyzer report read from local toolchain output (static), or a local timing-test harness and measured runtime samples (runtime). |
| Done | Static mode: the analyzer runs with warnings for every configuration in the target matrix and every reported instruction is traced to secret or public data before verdict. Runtime mode: a runtime test reports calibrated evidence of leakage or a bounded inconclusive result, with the exercised configuration named. |

## Inputs

- Mode: one of `static` (default) or `runtime`. Runtime mode fires when the user needs empirical timing evidence rather than inspection of emitted instructions.