Constant-Time Analysis

Compile the code, inspect the emitted assembly or bytecode for variable-time instructions, then decide which of the flagged operations actually touch secrets. The compilation step is mechanical; the triage step is the work.

When to Use

• Implementing or reviewing a signature, encryption, KEM, or key derivation routine
• Code applies / or % to a value derived from a key, plaintext, nonce, or token
• The user mentions "constant-time", "timing attack", "side-channel", or "KyberSlash"
• Reviewing functions named sign, verify, encrypt, decrypt, derive_key

When NOT to Use

• Measuring timing variance on a running binary, use the constant-time-testing skill from the testing-handbook-skills plugin, which covers dudect and statistical approaches and may not be installed. This skill inspects compiler output statically and never executes the code under test.
• Non-cryptographic code, or crypto code where every input is public
• High-level API usage where a vetted library owns the constant-time guarantees
• Cache and other microarchitectural side channels, the assembly view cannot see them

Language Routing

Read the guide for the target language before interpreting any findings; each one lists that language's dangerous instructions and the idiomatic constant-time replacements.

Guide	Languages
references/compiled.md	C, C++, Go, Rust
references/swift.md	Swift
references/vm-compiled.md	Java, C#
references/kotlin.md	Kotlin
references/php.md	PHP
references/javascript.md	JavaScript, TypeScript
references/python.md	Python
references/ruby.md	Ruby

Running the Analyzer