Skip to main content
Back to registry

constant-time-testing

trailofbits/skills

Timing attacks exploit variations in execution time to extract secret information from cryptographic implementations. Unlike cryptanalysis that targets theoretical weaknesses, timing attacks leverage implementation flaws - and they can affect any cryptographic code.

Installs750
Install command
npx skills add https://github.com/trailofbits/skills --skill constant-time-testing
Security audits
Gen Agent Trust HubPASS
SocketPASS
SnykPASS
About this skill
Timing attacks exploit variations in execution time to extract secret information from cryptographic implementations. Unlike cryptanalysis that targets theoretical weaknesses, timing attacks leverage implementation flaws - and they can affect any cryptographic code. Timing attacks were introduced by Kocher in 1996. Since then, researchers have demonstrated practical attacks on RSA ( Schindler ), OpenSSL ( Brumley and Boneh ), AES implementations, and even post-quantum algorithms like Kyber . Timing vulnerabilities can: Two prerequisites enable exploitation: Four patterns account for most timing vulnerabilities: Conditional jumps cause different code paths, leading to vast timing differences. Array access dependent on secrets enables cache-timing attacks, as shown in AES cache-timing research . Integer division and shift operations leak secrets on certain CPU architectures and compiler configurations. When patterns cannot be avoided, employ masking techniques to remove correlation between timing and secrets.

Source description provided by the upstream skill listing. Community reviews and install context appear in the sections below.

Community Reviews

Latest reviews

Sign in to review

No community reviews yet. Be the first to review.

Browse this skill in context
FAQ
What does constant-time-testing do?

Timing attacks exploit variations in execution time to extract secret information from cryptographic implementations. Unlike cryptanalysis that targets theoretical weaknesses, timing attacks leverage implementation flaws - and they can affect any cryptographic code.

Is constant-time-testing good?

constant-time-testing does not have approved reviews yet, so SkillJury cannot publish a community verdict.

What agent does constant-time-testing work with?

constant-time-testing currently lists compatibility with codex, gemini-cli, opencode, cursor, github-copilot, claude-code.

What are alternatives to constant-time-testing?

Skills in the same category include telegram-bot-builder, flutter-app-size, sharp-edges, iterative-retrieval.

How do I install constant-time-testing?

npx skills add https://github.com/trailofbits/skills --skill constant-time-testing

Related skills

More from trailofbits/skills

Related skills

Alternatives in Software Engineering