[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-trail-of-bits-constant-time-testing":3,"mdc-2k2106-key":35,"related-org-trail-of-bits-constant-time-testing":3031,"related-repo-trail-of-bits-constant-time-testing":3186},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":23,"repoUrl":24,"updatedAt":25,"license":26,"forks":27,"topics":28,"repo":30,"sourceUrl":33,"mdContent":34},"constant-time-testing","detect timing side channels in cryptographic code","Constant-time testing detects timing side channels in cryptographic code. Use when auditing crypto implementations for timing vulnerabilities.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"trail-of-bits","Trail of Bits","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Ftrail-of-bits.png","trailofbits",[13,17,20],{"name":14,"slug":15,"type":16},"Security","security","tag",{"name":18,"slug":19,"type":16},"Cryptography","cryptography",{"name":21,"slug":22,"type":16},"Code Analysis","code-analysis",6139,"https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills","2026-07-17T06:05:19.834472",null,541,[29],"agent-skills",{"repoUrl":24,"stars":23,"forks":27,"topics":31,"description":32},[29],"Trail of Bits Claude Code skills for security research, vulnerability detection, and audit workflows","https:\u002F\u002Fgithub.com\u002Ftrailofbits\u002Fskills\u002Ftree\u002FHEAD\u002Fplugins\u002Ftesting-handbook-skills\u002Fskills\u002Fconstant-time-testing","---\nname: constant-time-testing\ntype: domain\ndescription: >\n  Constant-time testing detects timing side channels in cryptographic code.\n  Use when auditing crypto implementations for timing vulnerabilities.\n---\n\n# Constant-Time Testing\n\nTiming attacks exploit variations in execution time to extract secret information from cryptographic implementations. Unlike cryptanalysis that targets theoretical weaknesses, timing attacks leverage implementation flaws - and they can affect any cryptographic code.\n\n## Background\n\nTiming attacks were introduced by [Kocher](https:\u002F\u002Fpaulkocher.com\u002Fdoc\u002FTimingAttacks.pdf) in 1996. Since then, researchers have demonstrated practical attacks on RSA ([Schindler](https:\u002F\u002Flink.springer.com\u002Fcontent\u002Fpdf\u002F10.1007\u002F3-540-44499-8_8.pdf)), OpenSSL ([Brumley and Boneh](https:\u002F\u002Fcrypto.stanford.edu\u002F~dabo\u002Fpapers\u002Fssl-timing.pdf)), AES implementations, and even post-quantum algorithms like [Kyber](https:\u002F\u002Feprint.iacr.org\u002F2024\u002F1049.pdf).\n\n### Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Constant-time | Code path and memory accesses independent of secret data |\n| Timing leakage | Observable execution time differences correlated with secrets |\n| Side channel | Information extracted from implementation rather than algorithm |\n| Microarchitecture | CPU-level timing differences (cache, division, shifts) |\n\n### Why This Matters\n\nTiming vulnerabilities can:\n- **Expose private keys** - Extract secret exponents in RSA\u002FECDH\n- **Enable remote attacks** - Network-observable timing differences\n- **Bypass cryptographic security** - Undermine theoretical guarantees\n- **Persist silently** - Often undetected without specialized analysis\n\nTwo prerequisites enable exploitation:\n1. **Access to oracle** - Sufficient queries to the vulnerable implementation\n2. **Timing dependency** - Correlation between execution time and secret data\n\n### Common Constant-Time Violation Patterns\n\nFour patterns account for most timing vulnerabilities:\n\n```c\n\u002F\u002F 1. Conditional jumps - most severe timing differences\nif(secret == 1) { ... }\nwhile(secret > 0) { ... }\n\n\u002F\u002F 2. Array access - cache-timing attacks\nlookup_table[secret];\n\n\u002F\u002F 3. Integer division (processor dependent)\ndata = secret \u002F m;\n\n\u002F\u002F 4. Shift operation (processor dependent)\ndata = a \u003C\u003C secret;\n```\n\n**Conditional jumps** cause different code paths, leading to vast timing differences.\n\n**Array access** dependent on secrets enables cache-timing attacks, as shown in [AES cache-timing research](https:\u002F\u002Fcr.yp.to\u002Fantiforgery\u002Fcachetiming-20050414.pdf).\n\n**Integer division and shift operations** leak secrets on certain CPU architectures and compiler configurations.\n\nWhen patterns cannot be avoided, employ [masking techniques](https:\u002F\u002Flink.springer.com\u002Fchapter\u002F10.1007\u002F978-3-642-38348-9_9) to remove correlation between timing and secrets.\n\n### Example: Modular Exponentiation Timing Attacks\n\nModular exponentiation (used in RSA and Diffie-Hellman) is susceptible to timing attacks. RSA decryption computes:\n\n$$ct^{d} \\mod{N}$$\n\nwhere $d$ is the secret exponent. The *exponentiation by squaring* optimization reduces multiplications to $\\log{d}$:\n\n$$\n\\begin{align*}\n& \\textbf{Input: } \\text{base }y,\\text{exponent } d=\\{d_n,\\cdots,d_0\\}_2,\\text{modulus } N \\\\\n& r = 1 \\\\\n& \\textbf{for } i=|n| \\text{ downto } 0: \\\\\n& \\quad\\textbf{if } d_i == 1: \\\\\n& \\quad\\quad r = r * y \\mod{N} \\\\\n& \\quad y = y * y \\mod{N} \\\\\n& \\textbf{return }r\n\\end{align*}\n$$\n\nThe code branches on exponent bit $d_i$, violating constant-time principles. When $d_i = 1$, an additional multiplication occurs, increasing execution time and leaking bit information.\n\nMontgomery multiplication (commonly used for modular arithmetic) also leaks timing: when intermediate values exceed modulus $N$, an additional reduction step is required. An attacker constructs inputs $y$ and $y'$ such that:\n\n$$\n\\begin{align*}\ny^2 \u003C y^3 \u003C N \\\\\ny'^2 \u003C N \\leq y'^3\n\\end{align*}\n$$\n\nFor $y$, both multiplications take time $t_1+t_1$. For $y'$, the second multiplication requires reduction, taking time $t_1+t_2$. This timing difference reveals whether $d_i$ is 0 or 1.\n\n## When to Use\n\n**Apply constant-time analysis when:**\n- Auditing cryptographic implementations (primitives, protocols)\n- Code handles secret keys, passwords, or sensitive cryptographic material\n- Implementing crypto algorithms from scratch\n- Reviewing PRs that touch crypto code\n- Investigating potential timing vulnerabilities\n\n**Consider alternatives when:**\n- Code does not process secret data\n- Public algorithms with no secret inputs\n- Non-cryptographic timing requirements (performance optimization)\n\n## Quick Reference\n\n| Scenario | Recommended Approach | Skill |\n|----------|---------------------|-------|\n| Prove absence of leaks | Formal verification | SideTrail, ct-verif, FaCT |\n| Detect statistical timing differences | Statistical testing | **dudect** |\n| Track secret data flow at runtime | Dynamic analysis | **timecop** |\n| Find cache-timing vulnerabilities | Symbolic execution | Binsec, pitchfork |\n\n## Constant-Time Tooling Categories\n\nThe cryptographic community has developed four categories of timing analysis tools:\n\n| Category | Approach | Pros | Cons |\n|----------|----------|------|------|\n| **Formal** | Mathematical proof on model | Guarantees absence of leaks | Complexity, modeling assumptions |\n| **Symbolic** | Symbolic execution paths | Concrete counterexamples | Time-intensive path exploration |\n| **Dynamic** | Runtime tracing with marked secrets | Granular, flexible | Limited coverage to executed paths |\n| **Statistical** | Measure real execution timing | Practical, simple setup | No root cause, noise sensitivity |\n\n### 1. Formal Tools\n\nFormal verification mathematically proves timing properties on an abstraction (model) of code. Tools create a model from source\u002Fbinary and verify it satisfies specified properties (e.g., variables annotated as secret).\n\n**Popular tools:**\n- [SideTrail](https:\u002F\u002Fgithub.com\u002Faws\u002Fs2n-tls\u002Ftree\u002Fmain\u002Ftests\u002Fsidetrail)\n- [ct-verif](https:\u002F\u002Fgithub.com\u002Fimdea-software\u002Fverifying-constant-time)\n- [FaCT](https:\u002F\u002Fgithub.com\u002Fplsyssec\u002Ffact)\n\n**Strengths:** Proof of absence, language-agnostic (LLVM bytecode)\n**Weaknesses:** Requires expertise, modeling assumptions may miss real-world issues\n\n### 2. Symbolic Tools\n\nSymbolic execution analyzes how paths and memory accesses depend on symbolic variables (secrets). Provides concrete counterexamples. Focus on cache-timing attacks.\n\n**Popular tools:**\n- [Binsec](https:\u002F\u002Fgithub.com\u002Fbinsec\u002Fbinsec)\n- [pitchfork](https:\u002F\u002Fgithub.com\u002FPLSysSec\u002Fhaybale-pitchfork)\n\n**Strengths:** Concrete counterexamples aid debugging\n**Weaknesses:** Path explosion leads to long execution times\n\n### 3. Dynamic Tools\n\nDynamic analysis marks sensitive memory regions and traces execution to detect timing-dependent operations.\n\n**Popular tools:**\n- [Memsan](https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FMemorySanitizer.html): [Tutorial](https:\u002F\u002Fcrocs-muni.github.io\u002Fct-tools\u002Ftutorials\u002Fmemsan)\n- **Timecop** (see below)\n\n**Strengths:** Granular control, targeted analysis\n**Weaknesses:** Coverage limited to executed paths\n\n> **Detailed Guidance:** See the **timecop** skill for setup and usage.\n\n### 4. Statistical Tools\n\nExecute code with various inputs, measure elapsed time, and detect inconsistencies. Tests actual implementation including compiler optimizations and architecture.\n\n**Popular tools:**\n- **dudect** (see below)\n- [tlsfuzzer](https:\u002F\u002Fgithub.com\u002Ftlsfuzzer\u002Ftlsfuzzer)\n\n**Strengths:** Simple setup, practical real-world results\n**Weaknesses:** No root cause info, noise obscures weak signals\n\n> **Detailed Guidance:** See the **dudect** skill for setup and usage.\n\n## Testing Workflow\n\n```\nPhase 1: Static Analysis        Phase 2: Statistical Testing\n┌─────────────────┐            ┌─────────────────┐\n│ Identify secret │      →     │ Detect timing   │\n│ data flow       │            │ differences     │\n│ Tool: ct-verif  │            │ Tool: dudect    │\n└─────────────────┘            └─────────────────┘\n         ↓                              ↓\nPhase 4: Root Cause             Phase 3: Dynamic Tracing\n┌─────────────────┐            ┌─────────────────┐\n│ Pinpoint leak   │      ←     │ Track secret    │\n│ location        │            │ propagation     │\n│ Tool: Timecop   │            │ Tool: Timecop   │\n└─────────────────┘            └─────────────────┘\n```\n\n**Recommended approach:**\n1. **Start with dudect** - Quick statistical check for timing differences\n2. **If leaks found** - Use Timecop to pinpoint root cause\n3. **For high-assurance** - Apply formal verification (ct-verif, SideTrail)\n4. **Continuous monitoring** - Integrate dudect into CI pipeline\n\n## Tools and Approaches\n\n### Dudect - Statistical Analysis\n\n[Dudect](https:\u002F\u002Fgithub.com\u002Foreparaz\u002Fdudect\u002F) measures execution time for two input classes (fixed vs random) and uses Welch's t-test to detect statistically significant differences.\n\n> **Detailed Guidance:** See the **dudect** skill for complete setup, usage patterns, and CI integration.\n\n#### Quick Start for Constant-Time Analysis\n\n```c\n#define DUDECT_IMPLEMENTATION\n#include \"dudect.h\"\n\nuint8_t do_one_computation(uint8_t *data) {\n    \u002F\u002F Code to measure goes here\n}\n\nvoid prepare_inputs(dudect_config_t *c, uint8_t *input_data, uint8_t *classes) {\n    for (size_t i = 0; i \u003C c->number_measurements; i++) {\n        classes[i] = randombit();\n        uint8_t *input = input_data + (size_t)i * c->chunk_size;\n        if (classes[i] == 0) {\n            \u002F\u002F Fixed input class\n        } else {\n            \u002F\u002F Random input class\n        }\n    }\n}\n```\n\n**Key advantages:**\n- Simple C header-only integration\n- Statistical rigor via Welch's t-test\n- Works with compiled binaries (real-world conditions)\n\n**Key limitations:**\n- No root cause information when leak detected\n- Sensitive to measurement noise\n- Cannot guarantee absence of leaks (statistical confidence only)\n\n### Timecop - Dynamic Tracing\n\n[Timecop](https:\u002F\u002Fpost-apocalyptic-crypto.org\u002Ftimecop\u002F) wraps Valgrind to detect runtime operations dependent on secret memory regions.\n\n> **Detailed Guidance:** See the **timecop** skill for installation, examples, and debugging.\n\n#### Quick Start for Constant-Time Analysis\n\n```c\n#include \"valgrind\u002Fmemcheck.h\"\n\n#define poison(addr, len) VALGRIND_MAKE_MEM_UNDEFINED(addr, len)\n#define unpoison(addr, len) VALGRIND_MAKE_MEM_DEFINED(addr, len)\n\nint main() {\n    unsigned long long secret_key = 0x12345678;\n\n    \u002F\u002F Mark secret as poisoned\n    poison(&secret_key, sizeof(secret_key));\n\n    \u002F\u002F Any branching or memory access dependent on secret_key\n    \u002F\u002F will be reported by Valgrind\n    crypto_operation(secret_key);\n\n    unpoison(&secret_key, sizeof(secret_key));\n}\n```\n\nRun with Valgrind:\n```bash\nvalgrind --leak-check=full --track-origins=yes .\u002Fbinary\n```\n\n**Key advantages:**\n- Pinpoints exact line of timing leak\n- No code instrumentation required\n- Tracks secret propagation through execution\n\n**Key limitations:**\n- Cannot detect microarchitecture timing differences\n- Coverage limited to executed paths\n- Performance overhead (runs on synthetic CPU)\n\n## Implementation Guide\n\n### Phase 1: Initial Assessment\n\n**Identify cryptographic code handling secrets:**\n- Private keys, exponents, nonces\n- Password hashes, authentication tokens\n- Encryption\u002Fdecryption operations\n\n**Quick statistical check:**\n1. Write dudect harness for the crypto function\n2. Run for 5-10 minutes with `timeout 600 .\u002Fct_test`\n3. Monitor t-value: high absolute values indicate leakage\n\n**Tools:** dudect\n**Expected time:** 1-2 hours (harness writing + initial run)\n\n### Phase 2: Detailed Analysis\n\nIf dudect detects leakage:\n\n**Root cause investigation:**\n1. Mark secret variables with Timecop `poison()`\n2. Run under Valgrind to identify exact line\n3. Review the four common violation patterns\n4. Check assembly output for conditional branches\n\n**Tools:** Timecop, compiler output (`objdump -d`)\n\n### Phase 3: Remediation\n\n**Fix the timing leak:**\n- Replace conditional branches with constant-time selection (bitwise operations)\n- Use constant-time comparison functions\n- Replace array lookups with constant-time alternatives or masking\n- Verify compiler doesn't optimize away constant-time code\n\n**Re-verify:**\n1. Run dudect again for extended period (30+ minutes)\n2. Test across different compilers and optimization levels\n3. Test on different CPU architectures\n\n### Phase 4: Continuous Monitoring\n\n**Integrate into CI:**\n- Add dudect tests to test suite\n- Run for fixed duration (5-10 minutes in CI)\n- Fail build if leakage detected\n\nSee the **dudect** skill for CI integration examples.\n\n## Common Vulnerabilities\n\n| Vulnerability | Description | Detection | Severity |\n|---------------|-------------|-----------|----------|\n| Secret-dependent branch | `if (secret_bit) { ... }` | dudect, Timecop | CRITICAL |\n| Secret-dependent array access | `table[secret_index]` | Timecop, Binsec | HIGH |\n| Variable-time division | `result = x \u002F secret` | Timecop | MEDIUM |\n| Variable-time shift | `result = x \u003C\u003C secret` | Timecop | MEDIUM |\n| Montgomery reduction leak | Extra reduction when intermediate > N | dudect | HIGH |\n\n### Secret-Dependent Branch: Deep Dive\n\n**The vulnerability:**\nExecution time differs based on whether branch is taken. Common in optimized modular exponentiation (square-and-multiply).\n\n**How to detect with dudect:**\n```c\nuint8_t do_one_computation(uint8_t *data) {\n    uint64_t base = ((uint64_t*)data)[0];\n    uint64_t exponent = ((uint64_t*)data)[1]; \u002F\u002F Secret!\n    return mod_exp(base, exponent, MODULUS);\n}\n\nvoid prepare_inputs(dudect_config_t *c, uint8_t *input_data, uint8_t *classes) {\n    for (size_t i = 0; i \u003C c->number_measurements; i++) {\n        classes[i] = randombit();\n        uint64_t *input = (uint64_t*)(input_data + i * c->chunk_size);\n        input[0] = rand(); \u002F\u002F Random base\n        input[1] = (classes[i] == 0) ? FIXED_EXPONENT : rand(); \u002F\u002F Fixed vs random\n    }\n}\n```\n\n**How to detect with Timecop:**\n```c\npoison(&exponent, sizeof(exponent));\nresult = mod_exp(base, exponent, modulus);\nunpoison(&exponent, sizeof(exponent));\n```\n\nValgrind will report:\n```\nConditional jump or move depends on uninitialised value(s)\n  at 0x40115D: mod_exp (example.c:14)\n```\n\n**Related skill:** **dudect**, **timecop**\n\n## Case Studies\n\n### Case Study: OpenSSL RSA Timing Attack\n\nBrumley and Boneh (2005) extracted RSA private keys from OpenSSL over a network. The vulnerability exploited Montgomery multiplication's variable-time reduction step.\n\n**Attack vector:** Timing differences in modular exponentiation\n**Detection approach:** Statistical analysis (precursor to dudect)\n**Impact:** Remote key extraction\n\n**Tools used:** Custom timing measurement\n**Techniques applied:** Statistical analysis, chosen-ciphertext queries\n\n### Case Study: KyberSlash\n\nPost-quantum algorithm Kyber's reference implementation contained timing vulnerabilities in polynomial operations. Division operations leaked secret coefficients.\n\n**Attack vector:** Secret-dependent division timing\n**Detection approach:** Dynamic analysis and statistical testing\n**Impact:** Secret key recovery in post-quantum cryptography\n\n**Tools used:** Timing measurement tools\n**Techniques applied:** Differential timing analysis\n\n## Advanced Usage\n\n### Tips and Tricks\n\n| Tip | Why It Helps |\n|-----|--------------|\n| Pin dudect to isolated CPU core (`taskset -c 2`) | Reduces OS noise, improves signal detection |\n| Test multiple compilers (gcc, clang, MSVC) | Optimizations may introduce or remove leaks |\n| Run dudect for extended periods (hours) | Increases statistical confidence |\n| Minimize non-crypto code in harness | Reduces noise that masks weak signals |\n| Check assembly output (`objdump -d`) | Verify compiler didn't introduce branches |\n| Use `-O3 -march=native` in testing | Matches production optimization levels |\n\n### Common Mistakes\n\n| Mistake | Why It's Wrong | Correct Approach |\n|---------|----------------|------------------|\n| Only testing one input distribution | May miss leaks visible with other patterns | Test fixed-vs-random, fixed-vs-fixed-different, etc. |\n| Short dudect runs (\u003C 1 minute) | Insufficient measurements for weak signals | Run 5-10+ minutes, longer for high assurance |\n| Ignoring compiler optimization levels | `-O0` may hide leaks present in `-O3` | Test at production optimization level |\n| Not testing on target architecture | x86 vs ARM have different timing characteristics | Test on deployment platform |\n| Marking too much as secret in Timecop | False positives, unclear results | Mark only true secrets (keys, not public data) |\n\n## Related Skills\n\n### Tool Skills\n\n| Skill | Primary Use in Constant-Time Analysis |\n|-------|---------------------------------------|\n| **dudect** | Statistical detection of timing differences via Welch's t-test |\n| **timecop** | Dynamic tracing to pinpoint exact location of timing leaks |\n\n### Technique Skills\n\n| Skill | When to Apply |\n|-------|---------------|\n| **coverage-analysis** | Ensure test inputs exercise all code paths in crypto function |\n| **ci-integration** | Automate constant-time testing in continuous integration pipeline |\n\n### Related Domain Skills\n\n| Skill | Relationship |\n|-------|--------------|\n| **crypto-testing** | Constant-time analysis is essential component of cryptographic testing |\n| **fuzzing** | Fuzzing crypto code may trigger timing-dependent paths |\n\n## Skill Dependency Map\n\n```\n                    ┌─────────────────────────┐\n                    │  constant-time-analysis │\n                    │     (this skill)        │\n                    └───────────┬─────────────┘\n                                │\n                ┌───────────────┴───────────────┐\n                │                               │\n                ▼                               ▼\n    ┌───────────────────┐           ┌───────────────────┐\n    │      dudect       │           │     timecop       │\n    │  (statistical)    │           │    (dynamic)      │\n    └────────┬──────────┘           └────────┬──────────┘\n             │                               │\n             └───────────────┬───────────────┘\n                             │\n                             ▼\n              ┌──────────────────────────────┐\n              │   Supporting Techniques      │\n              │ coverage, CI integration     │\n              └──────────────────────────────┘\n```\n\n## Resources\n\n### Key External Resources\n\n**[These results must be false: A usability evaluation of constant-time analysis tools](https:\u002F\u002Fwww.usenix.org\u002Fsystem\u002Ffiles\u002Fsec24fall-prepub-760-fourne.pdf)**\nComprehensive usability study of constant-time analysis tools. Key findings: developers struggle with false positives, need better error messages, and benefit from tool integration. Evaluates FaCT, ct-verif, dudect, and Memsan across multiple cryptographic implementations. Recommends improved tooling UX and better documentation.\n\n**[List of constant-time tools - CROCS](https:\u002F\u002Fcrocs-muni.github.io\u002Fct-tools\u002F)**\nCurated catalog of constant-time analysis tools with tutorials. Covers formal tools (ct-verif, FaCT), dynamic tools (Memsan, Timecop), symbolic tools (Binsec), and statistical tools (dudect). Includes practical tutorials for setup and usage.\n\n**[Paul Kocher: Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems](https:\u002F\u002Fpaulkocher.com\u002Fdoc\u002FTimingAttacks.pdf)**\nOriginal 1996 paper introducing timing attacks. Demonstrates attacks on modular exponentiation in RSA and Diffie-Hellman. Essential historical context for understanding timing vulnerabilities.\n\n**[Remote Timing Attacks are Practical (Brumley & Boneh)](https:\u002F\u002Fcrypto.stanford.edu\u002F~dabo\u002Fpapers\u002Fssl-timing.pdf)**\nDemonstrates practical remote timing attacks against OpenSSL. Shows network-level timing differences are sufficient to extract RSA keys. Proves timing attacks work in realistic network conditions.\n\n**[Cache-timing attacks on AES](https:\u002F\u002Fcr.yp.to\u002Fantiforgery\u002Fcachetiming-20050414.pdf)**\nShows AES implementations using lookup tables are vulnerable to cache-timing attacks. Demonstrates practical attacks extracting AES keys via cache timing side channels.\n\n**[KyberSlash: Division Timings Leak Secrets](https:\u002F\u002Feprint.iacr.org\u002F2024\u002F1049.pdf)**\nRecent discovery of timing vulnerabilities in Kyber (NIST post-quantum standard). Shows division operations leak secret coefficients. Highlights that constant-time issues persist even in modern post-quantum cryptography.\n\n### Video Resources\n\n- [Trail of Bits: Constant-Time Programming](https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=vW6wqTzfz5g) - Overview of constant-time programming principles and tools\n",{"data":36,"body":38},{"name":4,"type":37,"description":6},"domain",{"type":39,"children":40},"root",[41,49,55,62,105,112,192,198,203,249,254,278,284,289,410,420,438,448,462,468,473,478,491,496,501,506,511,516,522,530,558,566,584,590,695,701,706,842,848,853,861,894,911,917,922,929,952,967,973,978,985,1017,1032,1052,1058,1063,1070,1091,1106,1122,1128,1138,1146,1189,1195,1201,1213,1230,1237,1391,1399,1417,1425,1443,1449,1460,1477,1482,1619,1624,1658,1665,1683,1690,1708,1714,1720,1728,1746,1754,1778,1795,1801,1806,1814,1843,1860,1866,1874,1897,1905,1923,1929,1937,1955,1966,1972,2129,2135,2145,2153,2264,2272,2303,2308,2317,2337,2343,2349,2354,2378,2395,2401,2406,2427,2442,2448,2454,2575,2581,2710,2716,2722,2773,2779,2832,2838,2891,2897,2906,2912,2918,2933,2948,2962,2976,2990,3004,3010,3025],{"type":42,"tag":43,"props":44,"children":45},"element","h1",{"id":4},[46],{"type":47,"value":48},"text","Constant-Time Testing",{"type":42,"tag":50,"props":51,"children":52},"p",{},[53],{"type":47,"value":54},"Timing attacks exploit variations in execution time to extract secret information from cryptographic implementations. Unlike cryptanalysis that targets theoretical weaknesses, timing attacks leverage implementation flaws - and they can affect any cryptographic code.",{"type":42,"tag":56,"props":57,"children":59},"h2",{"id":58},"background",[60],{"type":47,"value":61},"Background",{"type":42,"tag":50,"props":63,"children":64},{},[65,67,76,78,85,87,94,96,103],{"type":47,"value":66},"Timing attacks were introduced by ",{"type":42,"tag":68,"props":69,"children":73},"a",{"href":70,"rel":71},"https:\u002F\u002Fpaulkocher.com\u002Fdoc\u002FTimingAttacks.pdf",[72],"nofollow",[74],{"type":47,"value":75},"Kocher",{"type":47,"value":77}," in 1996. Since then, researchers have demonstrated practical attacks on RSA (",{"type":42,"tag":68,"props":79,"children":82},{"href":80,"rel":81},"https:\u002F\u002Flink.springer.com\u002Fcontent\u002Fpdf\u002F10.1007\u002F3-540-44499-8_8.pdf",[72],[83],{"type":47,"value":84},"Schindler",{"type":47,"value":86},"), OpenSSL (",{"type":42,"tag":68,"props":88,"children":91},{"href":89,"rel":90},"https:\u002F\u002Fcrypto.stanford.edu\u002F~dabo\u002Fpapers\u002Fssl-timing.pdf",[72],[92],{"type":47,"value":93},"Brumley and Boneh",{"type":47,"value":95},"), AES implementations, and even post-quantum algorithms like ",{"type":42,"tag":68,"props":97,"children":100},{"href":98,"rel":99},"https:\u002F\u002Feprint.iacr.org\u002F2024\u002F1049.pdf",[72],[101],{"type":47,"value":102},"Kyber",{"type":47,"value":104},".",{"type":42,"tag":106,"props":107,"children":109},"h3",{"id":108},"key-concepts",[110],{"type":47,"value":111},"Key Concepts",{"type":42,"tag":113,"props":114,"children":115},"table",{},[116,135],{"type":42,"tag":117,"props":118,"children":119},"thead",{},[120],{"type":42,"tag":121,"props":122,"children":123},"tr",{},[124,130],{"type":42,"tag":125,"props":126,"children":127},"th",{},[128],{"type":47,"value":129},"Concept",{"type":42,"tag":125,"props":131,"children":132},{},[133],{"type":47,"value":134},"Description",{"type":42,"tag":136,"props":137,"children":138},"tbody",{},[139,153,166,179],{"type":42,"tag":121,"props":140,"children":141},{},[142,148],{"type":42,"tag":143,"props":144,"children":145},"td",{},[146],{"type":47,"value":147},"Constant-time",{"type":42,"tag":143,"props":149,"children":150},{},[151],{"type":47,"value":152},"Code path and memory accesses independent of secret data",{"type":42,"tag":121,"props":154,"children":155},{},[156,161],{"type":42,"tag":143,"props":157,"children":158},{},[159],{"type":47,"value":160},"Timing leakage",{"type":42,"tag":143,"props":162,"children":163},{},[164],{"type":47,"value":165},"Observable execution time differences correlated with secrets",{"type":42,"tag":121,"props":167,"children":168},{},[169,174],{"type":42,"tag":143,"props":170,"children":171},{},[172],{"type":47,"value":173},"Side channel",{"type":42,"tag":143,"props":175,"children":176},{},[177],{"type":47,"value":178},"Information extracted from implementation rather than algorithm",{"type":42,"tag":121,"props":180,"children":181},{},[182,187],{"type":42,"tag":143,"props":183,"children":184},{},[185],{"type":47,"value":186},"Microarchitecture",{"type":42,"tag":143,"props":188,"children":189},{},[190],{"type":47,"value":191},"CPU-level timing differences (cache, division, shifts)",{"type":42,"tag":106,"props":193,"children":195},{"id":194},"why-this-matters",[196],{"type":47,"value":197},"Why This Matters",{"type":42,"tag":50,"props":199,"children":200},{},[201],{"type":47,"value":202},"Timing vulnerabilities can:",{"type":42,"tag":204,"props":205,"children":206},"ul",{},[207,219,229,239],{"type":42,"tag":208,"props":209,"children":210},"li",{},[211,217],{"type":42,"tag":212,"props":213,"children":214},"strong",{},[215],{"type":47,"value":216},"Expose private keys",{"type":47,"value":218}," - Extract secret exponents in RSA\u002FECDH",{"type":42,"tag":208,"props":220,"children":221},{},[222,227],{"type":42,"tag":212,"props":223,"children":224},{},[225],{"type":47,"value":226},"Enable remote attacks",{"type":47,"value":228}," - Network-observable timing differences",{"type":42,"tag":208,"props":230,"children":231},{},[232,237],{"type":42,"tag":212,"props":233,"children":234},{},[235],{"type":47,"value":236},"Bypass cryptographic security",{"type":47,"value":238}," - Undermine theoretical guarantees",{"type":42,"tag":208,"props":240,"children":241},{},[242,247],{"type":42,"tag":212,"props":243,"children":244},{},[245],{"type":47,"value":246},"Persist silently",{"type":47,"value":248}," - Often undetected without specialized analysis",{"type":42,"tag":50,"props":250,"children":251},{},[252],{"type":47,"value":253},"Two prerequisites enable exploitation:",{"type":42,"tag":255,"props":256,"children":257},"ol",{},[258,268],{"type":42,"tag":208,"props":259,"children":260},{},[261,266],{"type":42,"tag":212,"props":262,"children":263},{},[264],{"type":47,"value":265},"Access to oracle",{"type":47,"value":267}," - Sufficient queries to the vulnerable implementation",{"type":42,"tag":208,"props":269,"children":270},{},[271,276],{"type":42,"tag":212,"props":272,"children":273},{},[274],{"type":47,"value":275},"Timing dependency",{"type":47,"value":277}," - Correlation between execution time and secret data",{"type":42,"tag":106,"props":279,"children":281},{"id":280},"common-constant-time-violation-patterns",[282],{"type":47,"value":283},"Common Constant-Time Violation Patterns",{"type":42,"tag":50,"props":285,"children":286},{},[287],{"type":47,"value":288},"Four patterns account for most timing vulnerabilities:",{"type":42,"tag":290,"props":291,"children":296},"pre",{"className":292,"code":293,"language":294,"meta":295,"style":295},"language-c shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","\u002F\u002F 1. Conditional jumps - most severe timing differences\nif(secret == 1) { ... }\nwhile(secret > 0) { ... }\n\n\u002F\u002F 2. Array access - cache-timing attacks\nlookup_table[secret];\n\n\u002F\u002F 3. Integer division (processor dependent)\ndata = secret \u002F m;\n\n\u002F\u002F 4. Shift operation (processor dependent)\ndata = a \u003C\u003C secret;\n","c","",[297],{"type":42,"tag":298,"props":299,"children":300},"code",{"__ignoreMap":295},[301,312,321,330,340,349,358,366,375,384,392,401],{"type":42,"tag":302,"props":303,"children":306},"span",{"class":304,"line":305},"line",1,[307],{"type":42,"tag":302,"props":308,"children":309},{},[310],{"type":47,"value":311},"\u002F\u002F 1. Conditional jumps - most severe timing differences\n",{"type":42,"tag":302,"props":313,"children":315},{"class":304,"line":314},2,[316],{"type":42,"tag":302,"props":317,"children":318},{},[319],{"type":47,"value":320},"if(secret == 1) { ... }\n",{"type":42,"tag":302,"props":322,"children":324},{"class":304,"line":323},3,[325],{"type":42,"tag":302,"props":326,"children":327},{},[328],{"type":47,"value":329},"while(secret > 0) { ... }\n",{"type":42,"tag":302,"props":331,"children":333},{"class":304,"line":332},4,[334],{"type":42,"tag":302,"props":335,"children":337},{"emptyLinePlaceholder":336},true,[338],{"type":47,"value":339},"\n",{"type":42,"tag":302,"props":341,"children":343},{"class":304,"line":342},5,[344],{"type":42,"tag":302,"props":345,"children":346},{},[347],{"type":47,"value":348},"\u002F\u002F 2. Array access - cache-timing attacks\n",{"type":42,"tag":302,"props":350,"children":352},{"class":304,"line":351},6,[353],{"type":42,"tag":302,"props":354,"children":355},{},[356],{"type":47,"value":357},"lookup_table[secret];\n",{"type":42,"tag":302,"props":359,"children":361},{"class":304,"line":360},7,[362],{"type":42,"tag":302,"props":363,"children":364},{"emptyLinePlaceholder":336},[365],{"type":47,"value":339},{"type":42,"tag":302,"props":367,"children":369},{"class":304,"line":368},8,[370],{"type":42,"tag":302,"props":371,"children":372},{},[373],{"type":47,"value":374},"\u002F\u002F 3. Integer division (processor dependent)\n",{"type":42,"tag":302,"props":376,"children":378},{"class":304,"line":377},9,[379],{"type":42,"tag":302,"props":380,"children":381},{},[382],{"type":47,"value":383},"data = secret \u002F m;\n",{"type":42,"tag":302,"props":385,"children":387},{"class":304,"line":386},10,[388],{"type":42,"tag":302,"props":389,"children":390},{"emptyLinePlaceholder":336},[391],{"type":47,"value":339},{"type":42,"tag":302,"props":393,"children":395},{"class":304,"line":394},11,[396],{"type":42,"tag":302,"props":397,"children":398},{},[399],{"type":47,"value":400},"\u002F\u002F 4. Shift operation (processor dependent)\n",{"type":42,"tag":302,"props":402,"children":404},{"class":304,"line":403},12,[405],{"type":42,"tag":302,"props":406,"children":407},{},[408],{"type":47,"value":409},"data = a \u003C\u003C secret;\n",{"type":42,"tag":50,"props":411,"children":412},{},[413,418],{"type":42,"tag":212,"props":414,"children":415},{},[416],{"type":47,"value":417},"Conditional jumps",{"type":47,"value":419}," cause different code paths, leading to vast timing differences.",{"type":42,"tag":50,"props":421,"children":422},{},[423,428,430,437],{"type":42,"tag":212,"props":424,"children":425},{},[426],{"type":47,"value":427},"Array access",{"type":47,"value":429}," dependent on secrets enables cache-timing attacks, as shown in ",{"type":42,"tag":68,"props":431,"children":434},{"href":432,"rel":433},"https:\u002F\u002Fcr.yp.to\u002Fantiforgery\u002Fcachetiming-20050414.pdf",[72],[435],{"type":47,"value":436},"AES cache-timing research",{"type":47,"value":104},{"type":42,"tag":50,"props":439,"children":440},{},[441,446],{"type":42,"tag":212,"props":442,"children":443},{},[444],{"type":47,"value":445},"Integer division and shift operations",{"type":47,"value":447}," leak secrets on certain CPU architectures and compiler configurations.",{"type":42,"tag":50,"props":449,"children":450},{},[451,453,460],{"type":47,"value":452},"When patterns cannot be avoided, employ ",{"type":42,"tag":68,"props":454,"children":457},{"href":455,"rel":456},"https:\u002F\u002Flink.springer.com\u002Fchapter\u002F10.1007\u002F978-3-642-38348-9_9",[72],[458],{"type":47,"value":459},"masking techniques",{"type":47,"value":461}," to remove correlation between timing and secrets.",{"type":42,"tag":106,"props":463,"children":465},{"id":464},"example-modular-exponentiation-timing-attacks",[466],{"type":47,"value":467},"Example: Modular Exponentiation Timing Attacks",{"type":42,"tag":50,"props":469,"children":470},{},[471],{"type":47,"value":472},"Modular exponentiation (used in RSA and Diffie-Hellman) is susceptible to timing attacks. RSA decryption computes:",{"type":42,"tag":50,"props":474,"children":475},{},[476],{"type":47,"value":477},"$$ct^{d} \\mod{N}$$",{"type":42,"tag":50,"props":479,"children":480},{},[481,483,489],{"type":47,"value":482},"where $d$ is the secret exponent. The ",{"type":42,"tag":484,"props":485,"children":486},"em",{},[487],{"type":47,"value":488},"exponentiation by squaring",{"type":47,"value":490}," optimization reduces multiplications to $\\log{d}$:",{"type":42,"tag":50,"props":492,"children":493},{},[494],{"type":47,"value":495},"$$\n\\begin{align*}\n& \\textbf{Input: } \\text{base }y,\\text{exponent } d={d_n,\\cdots,d_0}_2,\\text{modulus } N \\\n& r = 1 \\\n& \\textbf{for } i=|n| \\text{ downto } 0: \\\n& \\quad\\textbf{if } d_i == 1: \\\n& \\quad\\quad r = r * y \\mod{N} \\\n& \\quad y = y * y \\mod{N} \\\n& \\textbf{return }r\n\\end{align*}\n$$",{"type":42,"tag":50,"props":497,"children":498},{},[499],{"type":47,"value":500},"The code branches on exponent bit $d_i$, violating constant-time principles. When $d_i = 1$, an additional multiplication occurs, increasing execution time and leaking bit information.",{"type":42,"tag":50,"props":502,"children":503},{},[504],{"type":47,"value":505},"Montgomery multiplication (commonly used for modular arithmetic) also leaks timing: when intermediate values exceed modulus $N$, an additional reduction step is required. An attacker constructs inputs $y$ and $y'$ such that:",{"type":42,"tag":50,"props":507,"children":508},{},[509],{"type":47,"value":510},"$$\n\\begin{align*}\ny^2 \u003C y^3 \u003C N \\\ny'^2 \u003C N \\leq y'^3\n\\end{align*}\n$$",{"type":42,"tag":50,"props":512,"children":513},{},[514],{"type":47,"value":515},"For $y$, both multiplications take time $t_1+t_1$. For $y'$, the second multiplication requires reduction, taking time $t_1+t_2$. This timing difference reveals whether $d_i$ is 0 or 1.",{"type":42,"tag":56,"props":517,"children":519},{"id":518},"when-to-use",[520],{"type":47,"value":521},"When to Use",{"type":42,"tag":50,"props":523,"children":524},{},[525],{"type":42,"tag":212,"props":526,"children":527},{},[528],{"type":47,"value":529},"Apply constant-time analysis when:",{"type":42,"tag":204,"props":531,"children":532},{},[533,538,543,548,553],{"type":42,"tag":208,"props":534,"children":535},{},[536],{"type":47,"value":537},"Auditing cryptographic implementations (primitives, protocols)",{"type":42,"tag":208,"props":539,"children":540},{},[541],{"type":47,"value":542},"Code handles secret keys, passwords, or sensitive cryptographic material",{"type":42,"tag":208,"props":544,"children":545},{},[546],{"type":47,"value":547},"Implementing crypto algorithms from scratch",{"type":42,"tag":208,"props":549,"children":550},{},[551],{"type":47,"value":552},"Reviewing PRs that touch crypto code",{"type":42,"tag":208,"props":554,"children":555},{},[556],{"type":47,"value":557},"Investigating potential timing vulnerabilities",{"type":42,"tag":50,"props":559,"children":560},{},[561],{"type":42,"tag":212,"props":562,"children":563},{},[564],{"type":47,"value":565},"Consider alternatives when:",{"type":42,"tag":204,"props":567,"children":568},{},[569,574,579],{"type":42,"tag":208,"props":570,"children":571},{},[572],{"type":47,"value":573},"Code does not process secret data",{"type":42,"tag":208,"props":575,"children":576},{},[577],{"type":47,"value":578},"Public algorithms with no secret inputs",{"type":42,"tag":208,"props":580,"children":581},{},[582],{"type":47,"value":583},"Non-cryptographic timing requirements (performance optimization)",{"type":42,"tag":56,"props":585,"children":587},{"id":586},"quick-reference",[588],{"type":47,"value":589},"Quick Reference",{"type":42,"tag":113,"props":591,"children":592},{},[593,614],{"type":42,"tag":117,"props":594,"children":595},{},[596],{"type":42,"tag":121,"props":597,"children":598},{},[599,604,609],{"type":42,"tag":125,"props":600,"children":601},{},[602],{"type":47,"value":603},"Scenario",{"type":42,"tag":125,"props":605,"children":606},{},[607],{"type":47,"value":608},"Recommended Approach",{"type":42,"tag":125,"props":610,"children":611},{},[612],{"type":47,"value":613},"Skill",{"type":42,"tag":136,"props":615,"children":616},{},[617,635,656,677],{"type":42,"tag":121,"props":618,"children":619},{},[620,625,630],{"type":42,"tag":143,"props":621,"children":622},{},[623],{"type":47,"value":624},"Prove absence of leaks",{"type":42,"tag":143,"props":626,"children":627},{},[628],{"type":47,"value":629},"Formal verification",{"type":42,"tag":143,"props":631,"children":632},{},[633],{"type":47,"value":634},"SideTrail, ct-verif, FaCT",{"type":42,"tag":121,"props":636,"children":637},{},[638,643,648],{"type":42,"tag":143,"props":639,"children":640},{},[641],{"type":47,"value":642},"Detect statistical timing differences",{"type":42,"tag":143,"props":644,"children":645},{},[646],{"type":47,"value":647},"Statistical testing",{"type":42,"tag":143,"props":649,"children":650},{},[651],{"type":42,"tag":212,"props":652,"children":653},{},[654],{"type":47,"value":655},"dudect",{"type":42,"tag":121,"props":657,"children":658},{},[659,664,669],{"type":42,"tag":143,"props":660,"children":661},{},[662],{"type":47,"value":663},"Track secret data flow at runtime",{"type":42,"tag":143,"props":665,"children":666},{},[667],{"type":47,"value":668},"Dynamic analysis",{"type":42,"tag":143,"props":670,"children":671},{},[672],{"type":42,"tag":212,"props":673,"children":674},{},[675],{"type":47,"value":676},"timecop",{"type":42,"tag":121,"props":678,"children":679},{},[680,685,690],{"type":42,"tag":143,"props":681,"children":682},{},[683],{"type":47,"value":684},"Find cache-timing vulnerabilities",{"type":42,"tag":143,"props":686,"children":687},{},[688],{"type":47,"value":689},"Symbolic execution",{"type":42,"tag":143,"props":691,"children":692},{},[693],{"type":47,"value":694},"Binsec, pitchfork",{"type":42,"tag":56,"props":696,"children":698},{"id":697},"constant-time-tooling-categories",[699],{"type":47,"value":700},"Constant-Time Tooling Categories",{"type":42,"tag":50,"props":702,"children":703},{},[704],{"type":47,"value":705},"The cryptographic community has developed four categories of timing analysis tools:",{"type":42,"tag":113,"props":707,"children":708},{},[709,735],{"type":42,"tag":117,"props":710,"children":711},{},[712],{"type":42,"tag":121,"props":713,"children":714},{},[715,720,725,730],{"type":42,"tag":125,"props":716,"children":717},{},[718],{"type":47,"value":719},"Category",{"type":42,"tag":125,"props":721,"children":722},{},[723],{"type":47,"value":724},"Approach",{"type":42,"tag":125,"props":726,"children":727},{},[728],{"type":47,"value":729},"Pros",{"type":42,"tag":125,"props":731,"children":732},{},[733],{"type":47,"value":734},"Cons",{"type":42,"tag":136,"props":736,"children":737},{},[738,764,790,816],{"type":42,"tag":121,"props":739,"children":740},{},[741,749,754,759],{"type":42,"tag":143,"props":742,"children":743},{},[744],{"type":42,"tag":212,"props":745,"children":746},{},[747],{"type":47,"value":748},"Formal",{"type":42,"tag":143,"props":750,"children":751},{},[752],{"type":47,"value":753},"Mathematical proof on model",{"type":42,"tag":143,"props":755,"children":756},{},[757],{"type":47,"value":758},"Guarantees absence of leaks",{"type":42,"tag":143,"props":760,"children":761},{},[762],{"type":47,"value":763},"Complexity, modeling assumptions",{"type":42,"tag":121,"props":765,"children":766},{},[767,775,780,785],{"type":42,"tag":143,"props":768,"children":769},{},[770],{"type":42,"tag":212,"props":771,"children":772},{},[773],{"type":47,"value":774},"Symbolic",{"type":42,"tag":143,"props":776,"children":777},{},[778],{"type":47,"value":779},"Symbolic execution paths",{"type":42,"tag":143,"props":781,"children":782},{},[783],{"type":47,"value":784},"Concrete counterexamples",{"type":42,"tag":143,"props":786,"children":787},{},[788],{"type":47,"value":789},"Time-intensive path exploration",{"type":42,"tag":121,"props":791,"children":792},{},[793,801,806,811],{"type":42,"tag":143,"props":794,"children":795},{},[796],{"type":42,"tag":212,"props":797,"children":798},{},[799],{"type":47,"value":800},"Dynamic",{"type":42,"tag":143,"props":802,"children":803},{},[804],{"type":47,"value":805},"Runtime tracing with marked secrets",{"type":42,"tag":143,"props":807,"children":808},{},[809],{"type":47,"value":810},"Granular, flexible",{"type":42,"tag":143,"props":812,"children":813},{},[814],{"type":47,"value":815},"Limited coverage to executed paths",{"type":42,"tag":121,"props":817,"children":818},{},[819,827,832,837],{"type":42,"tag":143,"props":820,"children":821},{},[822],{"type":42,"tag":212,"props":823,"children":824},{},[825],{"type":47,"value":826},"Statistical",{"type":42,"tag":143,"props":828,"children":829},{},[830],{"type":47,"value":831},"Measure real execution timing",{"type":42,"tag":143,"props":833,"children":834},{},[835],{"type":47,"value":836},"Practical, simple setup",{"type":42,"tag":143,"props":838,"children":839},{},[840],{"type":47,"value":841},"No root cause, noise sensitivity",{"type":42,"tag":106,"props":843,"children":845},{"id":844},"_1-formal-tools",[846],{"type":47,"value":847},"1. Formal Tools",{"type":42,"tag":50,"props":849,"children":850},{},[851],{"type":47,"value":852},"Formal verification mathematically proves timing properties on an abstraction (model) of code. Tools create a model from source\u002Fbinary and verify it satisfies specified properties (e.g., variables annotated as secret).",{"type":42,"tag":50,"props":854,"children":855},{},[856],{"type":42,"tag":212,"props":857,"children":858},{},[859],{"type":47,"value":860},"Popular tools:",{"type":42,"tag":204,"props":862,"children":863},{},[864,874,884],{"type":42,"tag":208,"props":865,"children":866},{},[867],{"type":42,"tag":68,"props":868,"children":871},{"href":869,"rel":870},"https:\u002F\u002Fgithub.com\u002Faws\u002Fs2n-tls\u002Ftree\u002Fmain\u002Ftests\u002Fsidetrail",[72],[872],{"type":47,"value":873},"SideTrail",{"type":42,"tag":208,"props":875,"children":876},{},[877],{"type":42,"tag":68,"props":878,"children":881},{"href":879,"rel":880},"https:\u002F\u002Fgithub.com\u002Fimdea-software\u002Fverifying-constant-time",[72],[882],{"type":47,"value":883},"ct-verif",{"type":42,"tag":208,"props":885,"children":886},{},[887],{"type":42,"tag":68,"props":888,"children":891},{"href":889,"rel":890},"https:\u002F\u002Fgithub.com\u002Fplsyssec\u002Ffact",[72],[892],{"type":47,"value":893},"FaCT",{"type":42,"tag":50,"props":895,"children":896},{},[897,902,904,909],{"type":42,"tag":212,"props":898,"children":899},{},[900],{"type":47,"value":901},"Strengths:",{"type":47,"value":903}," Proof of absence, language-agnostic (LLVM bytecode)\n",{"type":42,"tag":212,"props":905,"children":906},{},[907],{"type":47,"value":908},"Weaknesses:",{"type":47,"value":910}," Requires expertise, modeling assumptions may miss real-world issues",{"type":42,"tag":106,"props":912,"children":914},{"id":913},"_2-symbolic-tools",[915],{"type":47,"value":916},"2. Symbolic Tools",{"type":42,"tag":50,"props":918,"children":919},{},[920],{"type":47,"value":921},"Symbolic execution analyzes how paths and memory accesses depend on symbolic variables (secrets). Provides concrete counterexamples. Focus on cache-timing attacks.",{"type":42,"tag":50,"props":923,"children":924},{},[925],{"type":42,"tag":212,"props":926,"children":927},{},[928],{"type":47,"value":860},{"type":42,"tag":204,"props":930,"children":931},{},[932,942],{"type":42,"tag":208,"props":933,"children":934},{},[935],{"type":42,"tag":68,"props":936,"children":939},{"href":937,"rel":938},"https:\u002F\u002Fgithub.com\u002Fbinsec\u002Fbinsec",[72],[940],{"type":47,"value":941},"Binsec",{"type":42,"tag":208,"props":943,"children":944},{},[945],{"type":42,"tag":68,"props":946,"children":949},{"href":947,"rel":948},"https:\u002F\u002Fgithub.com\u002FPLSysSec\u002Fhaybale-pitchfork",[72],[950],{"type":47,"value":951},"pitchfork",{"type":42,"tag":50,"props":953,"children":954},{},[955,959,961,965],{"type":42,"tag":212,"props":956,"children":957},{},[958],{"type":47,"value":901},{"type":47,"value":960}," Concrete counterexamples aid debugging\n",{"type":42,"tag":212,"props":962,"children":963},{},[964],{"type":47,"value":908},{"type":47,"value":966}," Path explosion leads to long execution times",{"type":42,"tag":106,"props":968,"children":970},{"id":969},"_3-dynamic-tools",[971],{"type":47,"value":972},"3. Dynamic Tools",{"type":42,"tag":50,"props":974,"children":975},{},[976],{"type":47,"value":977},"Dynamic analysis marks sensitive memory regions and traces execution to detect timing-dependent operations.",{"type":42,"tag":50,"props":979,"children":980},{},[981],{"type":42,"tag":212,"props":982,"children":983},{},[984],{"type":47,"value":860},{"type":42,"tag":204,"props":986,"children":987},{},[988,1007],{"type":42,"tag":208,"props":989,"children":990},{},[991,998,1000],{"type":42,"tag":68,"props":992,"children":995},{"href":993,"rel":994},"https:\u002F\u002Fclang.llvm.org\u002Fdocs\u002FMemorySanitizer.html",[72],[996],{"type":47,"value":997},"Memsan",{"type":47,"value":999},": ",{"type":42,"tag":68,"props":1001,"children":1004},{"href":1002,"rel":1003},"https:\u002F\u002Fcrocs-muni.github.io\u002Fct-tools\u002Ftutorials\u002Fmemsan",[72],[1005],{"type":47,"value":1006},"Tutorial",{"type":42,"tag":208,"props":1008,"children":1009},{},[1010,1015],{"type":42,"tag":212,"props":1011,"children":1012},{},[1013],{"type":47,"value":1014},"Timecop",{"type":47,"value":1016}," (see below)",{"type":42,"tag":50,"props":1018,"children":1019},{},[1020,1024,1026,1030],{"type":42,"tag":212,"props":1021,"children":1022},{},[1023],{"type":47,"value":901},{"type":47,"value":1025}," Granular control, targeted analysis\n",{"type":42,"tag":212,"props":1027,"children":1028},{},[1029],{"type":47,"value":908},{"type":47,"value":1031}," Coverage limited to executed paths",{"type":42,"tag":1033,"props":1034,"children":1035},"blockquote",{},[1036],{"type":42,"tag":50,"props":1037,"children":1038},{},[1039,1044,1046,1050],{"type":42,"tag":212,"props":1040,"children":1041},{},[1042],{"type":47,"value":1043},"Detailed Guidance:",{"type":47,"value":1045}," See the ",{"type":42,"tag":212,"props":1047,"children":1048},{},[1049],{"type":47,"value":676},{"type":47,"value":1051}," skill for setup and usage.",{"type":42,"tag":106,"props":1053,"children":1055},{"id":1054},"_4-statistical-tools",[1056],{"type":47,"value":1057},"4. Statistical Tools",{"type":42,"tag":50,"props":1059,"children":1060},{},[1061],{"type":47,"value":1062},"Execute code with various inputs, measure elapsed time, and detect inconsistencies. Tests actual implementation including compiler optimizations and architecture.",{"type":42,"tag":50,"props":1064,"children":1065},{},[1066],{"type":42,"tag":212,"props":1067,"children":1068},{},[1069],{"type":47,"value":860},{"type":42,"tag":204,"props":1071,"children":1072},{},[1073,1081],{"type":42,"tag":208,"props":1074,"children":1075},{},[1076,1080],{"type":42,"tag":212,"props":1077,"children":1078},{},[1079],{"type":47,"value":655},{"type":47,"value":1016},{"type":42,"tag":208,"props":1082,"children":1083},{},[1084],{"type":42,"tag":68,"props":1085,"children":1088},{"href":1086,"rel":1087},"https:\u002F\u002Fgithub.com\u002Ftlsfuzzer\u002Ftlsfuzzer",[72],[1089],{"type":47,"value":1090},"tlsfuzzer",{"type":42,"tag":50,"props":1092,"children":1093},{},[1094,1098,1100,1104],{"type":42,"tag":212,"props":1095,"children":1096},{},[1097],{"type":47,"value":901},{"type":47,"value":1099}," Simple setup, practical real-world results\n",{"type":42,"tag":212,"props":1101,"children":1102},{},[1103],{"type":47,"value":908},{"type":47,"value":1105}," No root cause info, noise obscures weak signals",{"type":42,"tag":1033,"props":1107,"children":1108},{},[1109],{"type":42,"tag":50,"props":1110,"children":1111},{},[1112,1116,1117,1121],{"type":42,"tag":212,"props":1113,"children":1114},{},[1115],{"type":47,"value":1043},{"type":47,"value":1045},{"type":42,"tag":212,"props":1118,"children":1119},{},[1120],{"type":47,"value":655},{"type":47,"value":1051},{"type":42,"tag":56,"props":1123,"children":1125},{"id":1124},"testing-workflow",[1126],{"type":47,"value":1127},"Testing Workflow",{"type":42,"tag":290,"props":1129,"children":1133},{"className":1130,"code":1132,"language":47},[1131],"language-text","Phase 1: Static Analysis        Phase 2: Statistical Testing\n┌─────────────────┐            ┌─────────────────┐\n│ Identify secret │      →     │ Detect timing   │\n│ data flow       │            │ differences     │\n│ Tool: ct-verif  │            │ Tool: dudect    │\n└─────────────────┘            └─────────────────┘\n         ↓                              ↓\nPhase 4: Root Cause             Phase 3: Dynamic Tracing\n┌─────────────────┐            ┌─────────────────┐\n│ Pinpoint leak   │      ←     │ Track secret    │\n│ location        │            │ propagation     │\n│ Tool: Timecop   │            │ Tool: Timecop   │\n└─────────────────┘            └─────────────────┘\n",[1134],{"type":42,"tag":298,"props":1135,"children":1136},{"__ignoreMap":295},[1137],{"type":47,"value":1132},{"type":42,"tag":50,"props":1139,"children":1140},{},[1141],{"type":42,"tag":212,"props":1142,"children":1143},{},[1144],{"type":47,"value":1145},"Recommended approach:",{"type":42,"tag":255,"props":1147,"children":1148},{},[1149,1159,1169,1179],{"type":42,"tag":208,"props":1150,"children":1151},{},[1152,1157],{"type":42,"tag":212,"props":1153,"children":1154},{},[1155],{"type":47,"value":1156},"Start with dudect",{"type":47,"value":1158}," - Quick statistical check for timing differences",{"type":42,"tag":208,"props":1160,"children":1161},{},[1162,1167],{"type":42,"tag":212,"props":1163,"children":1164},{},[1165],{"type":47,"value":1166},"If leaks found",{"type":47,"value":1168}," - Use Timecop to pinpoint root cause",{"type":42,"tag":208,"props":1170,"children":1171},{},[1172,1177],{"type":42,"tag":212,"props":1173,"children":1174},{},[1175],{"type":47,"value":1176},"For high-assurance",{"type":47,"value":1178}," - Apply formal verification (ct-verif, SideTrail)",{"type":42,"tag":208,"props":1180,"children":1181},{},[1182,1187],{"type":42,"tag":212,"props":1183,"children":1184},{},[1185],{"type":47,"value":1186},"Continuous monitoring",{"type":47,"value":1188}," - Integrate dudect into CI pipeline",{"type":42,"tag":56,"props":1190,"children":1192},{"id":1191},"tools-and-approaches",[1193],{"type":47,"value":1194},"Tools and Approaches",{"type":42,"tag":106,"props":1196,"children":1198},{"id":1197},"dudect-statistical-analysis",[1199],{"type":47,"value":1200},"Dudect - Statistical Analysis",{"type":42,"tag":50,"props":1202,"children":1203},{},[1204,1211],{"type":42,"tag":68,"props":1205,"children":1208},{"href":1206,"rel":1207},"https:\u002F\u002Fgithub.com\u002Foreparaz\u002Fdudect\u002F",[72],[1209],{"type":47,"value":1210},"Dudect",{"type":47,"value":1212}," measures execution time for two input classes (fixed vs random) and uses Welch's t-test to detect statistically significant differences.",{"type":42,"tag":1033,"props":1214,"children":1215},{},[1216],{"type":42,"tag":50,"props":1217,"children":1218},{},[1219,1223,1224,1228],{"type":42,"tag":212,"props":1220,"children":1221},{},[1222],{"type":47,"value":1043},{"type":47,"value":1045},{"type":42,"tag":212,"props":1225,"children":1226},{},[1227],{"type":47,"value":655},{"type":47,"value":1229}," skill for complete setup, usage patterns, and CI integration.",{"type":42,"tag":1231,"props":1232,"children":1234},"h4",{"id":1233},"quick-start-for-constant-time-analysis",[1235],{"type":47,"value":1236},"Quick Start for Constant-Time Analysis",{"type":42,"tag":290,"props":1238,"children":1240},{"className":292,"code":1239,"language":294,"meta":295,"style":295},"#define DUDECT_IMPLEMENTATION\n#include \"dudect.h\"\n\nuint8_t do_one_computation(uint8_t *data) {\n    \u002F\u002F Code to measure goes here\n}\n\nvoid prepare_inputs(dudect_config_t *c, uint8_t *input_data, uint8_t *classes) {\n    for (size_t i = 0; i \u003C c->number_measurements; i++) {\n        classes[i] = randombit();\n        uint8_t *input = input_data + (size_t)i * c->chunk_size;\n        if (classes[i] == 0) {\n            \u002F\u002F Fixed input class\n        } else {\n            \u002F\u002F Random input class\n        }\n    }\n}\n",[1241],{"type":42,"tag":298,"props":1242,"children":1243},{"__ignoreMap":295},[1244,1252,1260,1267,1275,1283,1291,1298,1306,1314,1322,1330,1338,1347,1356,1365,1374,1383],{"type":42,"tag":302,"props":1245,"children":1246},{"class":304,"line":305},[1247],{"type":42,"tag":302,"props":1248,"children":1249},{},[1250],{"type":47,"value":1251},"#define DUDECT_IMPLEMENTATION\n",{"type":42,"tag":302,"props":1253,"children":1254},{"class":304,"line":314},[1255],{"type":42,"tag":302,"props":1256,"children":1257},{},[1258],{"type":47,"value":1259},"#include \"dudect.h\"\n",{"type":42,"tag":302,"props":1261,"children":1262},{"class":304,"line":323},[1263],{"type":42,"tag":302,"props":1264,"children":1265},{"emptyLinePlaceholder":336},[1266],{"type":47,"value":339},{"type":42,"tag":302,"props":1268,"children":1269},{"class":304,"line":332},[1270],{"type":42,"tag":302,"props":1271,"children":1272},{},[1273],{"type":47,"value":1274},"uint8_t do_one_computation(uint8_t *data) {\n",{"type":42,"tag":302,"props":1276,"children":1277},{"class":304,"line":342},[1278],{"type":42,"tag":302,"props":1279,"children":1280},{},[1281],{"type":47,"value":1282},"    \u002F\u002F Code to measure goes here\n",{"type":42,"tag":302,"props":1284,"children":1285},{"class":304,"line":351},[1286],{"type":42,"tag":302,"props":1287,"children":1288},{},[1289],{"type":47,"value":1290},"}\n",{"type":42,"tag":302,"props":1292,"children":1293},{"class":304,"line":360},[1294],{"type":42,"tag":302,"props":1295,"children":1296},{"emptyLinePlaceholder":336},[1297],{"type":47,"value":339},{"type":42,"tag":302,"props":1299,"children":1300},{"class":304,"line":368},[1301],{"type":42,"tag":302,"props":1302,"children":1303},{},[1304],{"type":47,"value":1305},"void prepare_inputs(dudect_config_t *c, uint8_t *input_data, uint8_t *classes) {\n",{"type":42,"tag":302,"props":1307,"children":1308},{"class":304,"line":377},[1309],{"type":42,"tag":302,"props":1310,"children":1311},{},[1312],{"type":47,"value":1313},"    for (size_t i = 0; i \u003C c->number_measurements; i++) {\n",{"type":42,"tag":302,"props":1315,"children":1316},{"class":304,"line":386},[1317],{"type":42,"tag":302,"props":1318,"children":1319},{},[1320],{"type":47,"value":1321},"        classes[i] = randombit();\n",{"type":42,"tag":302,"props":1323,"children":1324},{"class":304,"line":394},[1325],{"type":42,"tag":302,"props":1326,"children":1327},{},[1328],{"type":47,"value":1329},"        uint8_t *input = input_data + (size_t)i * c->chunk_size;\n",{"type":42,"tag":302,"props":1331,"children":1332},{"class":304,"line":403},[1333],{"type":42,"tag":302,"props":1334,"children":1335},{},[1336],{"type":47,"value":1337},"        if (classes[i] == 0) {\n",{"type":42,"tag":302,"props":1339,"children":1341},{"class":304,"line":1340},13,[1342],{"type":42,"tag":302,"props":1343,"children":1344},{},[1345],{"type":47,"value":1346},"            \u002F\u002F Fixed input class\n",{"type":42,"tag":302,"props":1348,"children":1350},{"class":304,"line":1349},14,[1351],{"type":42,"tag":302,"props":1352,"children":1353},{},[1354],{"type":47,"value":1355},"        } else {\n",{"type":42,"tag":302,"props":1357,"children":1359},{"class":304,"line":1358},15,[1360],{"type":42,"tag":302,"props":1361,"children":1362},{},[1363],{"type":47,"value":1364},"            \u002F\u002F Random input class\n",{"type":42,"tag":302,"props":1366,"children":1368},{"class":304,"line":1367},16,[1369],{"type":42,"tag":302,"props":1370,"children":1371},{},[1372],{"type":47,"value":1373},"        }\n",{"type":42,"tag":302,"props":1375,"children":1377},{"class":304,"line":1376},17,[1378],{"type":42,"tag":302,"props":1379,"children":1380},{},[1381],{"type":47,"value":1382},"    }\n",{"type":42,"tag":302,"props":1384,"children":1386},{"class":304,"line":1385},18,[1387],{"type":42,"tag":302,"props":1388,"children":1389},{},[1390],{"type":47,"value":1290},{"type":42,"tag":50,"props":1392,"children":1393},{},[1394],{"type":42,"tag":212,"props":1395,"children":1396},{},[1397],{"type":47,"value":1398},"Key advantages:",{"type":42,"tag":204,"props":1400,"children":1401},{},[1402,1407,1412],{"type":42,"tag":208,"props":1403,"children":1404},{},[1405],{"type":47,"value":1406},"Simple C header-only integration",{"type":42,"tag":208,"props":1408,"children":1409},{},[1410],{"type":47,"value":1411},"Statistical rigor via Welch's t-test",{"type":42,"tag":208,"props":1413,"children":1414},{},[1415],{"type":47,"value":1416},"Works with compiled binaries (real-world conditions)",{"type":42,"tag":50,"props":1418,"children":1419},{},[1420],{"type":42,"tag":212,"props":1421,"children":1422},{},[1423],{"type":47,"value":1424},"Key limitations:",{"type":42,"tag":204,"props":1426,"children":1427},{},[1428,1433,1438],{"type":42,"tag":208,"props":1429,"children":1430},{},[1431],{"type":47,"value":1432},"No root cause information when leak detected",{"type":42,"tag":208,"props":1434,"children":1435},{},[1436],{"type":47,"value":1437},"Sensitive to measurement noise",{"type":42,"tag":208,"props":1439,"children":1440},{},[1441],{"type":47,"value":1442},"Cannot guarantee absence of leaks (statistical confidence only)",{"type":42,"tag":106,"props":1444,"children":1446},{"id":1445},"timecop-dynamic-tracing",[1447],{"type":47,"value":1448},"Timecop - Dynamic Tracing",{"type":42,"tag":50,"props":1450,"children":1451},{},[1452,1458],{"type":42,"tag":68,"props":1453,"children":1456},{"href":1454,"rel":1455},"https:\u002F\u002Fpost-apocalyptic-crypto.org\u002Ftimecop\u002F",[72],[1457],{"type":47,"value":1014},{"type":47,"value":1459}," wraps Valgrind to detect runtime operations dependent on secret memory regions.",{"type":42,"tag":1033,"props":1461,"children":1462},{},[1463],{"type":42,"tag":50,"props":1464,"children":1465},{},[1466,1470,1471,1475],{"type":42,"tag":212,"props":1467,"children":1468},{},[1469],{"type":47,"value":1043},{"type":47,"value":1045},{"type":42,"tag":212,"props":1472,"children":1473},{},[1474],{"type":47,"value":676},{"type":47,"value":1476}," skill for installation, examples, and debugging.",{"type":42,"tag":1231,"props":1478,"children":1480},{"id":1479},"quick-start-for-constant-time-analysis-1",[1481],{"type":47,"value":1236},{"type":42,"tag":290,"props":1483,"children":1485},{"className":292,"code":1484,"language":294,"meta":295,"style":295},"#include \"valgrind\u002Fmemcheck.h\"\n\n#define poison(addr, len) VALGRIND_MAKE_MEM_UNDEFINED(addr, len)\n#define unpoison(addr, len) VALGRIND_MAKE_MEM_DEFINED(addr, len)\n\nint main() {\n    unsigned long long secret_key = 0x12345678;\n\n    \u002F\u002F Mark secret as poisoned\n    poison(&secret_key, sizeof(secret_key));\n\n    \u002F\u002F Any branching or memory access dependent on secret_key\n    \u002F\u002F will be reported by Valgrind\n    crypto_operation(secret_key);\n\n    unpoison(&secret_key, sizeof(secret_key));\n}\n",[1486],{"type":42,"tag":298,"props":1487,"children":1488},{"__ignoreMap":295},[1489,1497,1504,1512,1520,1527,1535,1543,1550,1558,1566,1573,1581,1589,1597,1604,1612],{"type":42,"tag":302,"props":1490,"children":1491},{"class":304,"line":305},[1492],{"type":42,"tag":302,"props":1493,"children":1494},{},[1495],{"type":47,"value":1496},"#include \"valgrind\u002Fmemcheck.h\"\n",{"type":42,"tag":302,"props":1498,"children":1499},{"class":304,"line":314},[1500],{"type":42,"tag":302,"props":1501,"children":1502},{"emptyLinePlaceholder":336},[1503],{"type":47,"value":339},{"type":42,"tag":302,"props":1505,"children":1506},{"class":304,"line":323},[1507],{"type":42,"tag":302,"props":1508,"children":1509},{},[1510],{"type":47,"value":1511},"#define poison(addr, len) VALGRIND_MAKE_MEM_UNDEFINED(addr, len)\n",{"type":42,"tag":302,"props":1513,"children":1514},{"class":304,"line":332},[1515],{"type":42,"tag":302,"props":1516,"children":1517},{},[1518],{"type":47,"value":1519},"#define unpoison(addr, len) VALGRIND_MAKE_MEM_DEFINED(addr, len)\n",{"type":42,"tag":302,"props":1521,"children":1522},{"class":304,"line":342},[1523],{"type":42,"tag":302,"props":1524,"children":1525},{"emptyLinePlaceholder":336},[1526],{"type":47,"value":339},{"type":42,"tag":302,"props":1528,"children":1529},{"class":304,"line":351},[1530],{"type":42,"tag":302,"props":1531,"children":1532},{},[1533],{"type":47,"value":1534},"int main() {\n",{"type":42,"tag":302,"props":1536,"children":1537},{"class":304,"line":360},[1538],{"type":42,"tag":302,"props":1539,"children":1540},{},[1541],{"type":47,"value":1542},"    unsigned long long secret_key = 0x12345678;\n",{"type":42,"tag":302,"props":1544,"children":1545},{"class":304,"line":368},[1546],{"type":42,"tag":302,"props":1547,"children":1548},{"emptyLinePlaceholder":336},[1549],{"type":47,"value":339},{"type":42,"tag":302,"props":1551,"children":1552},{"class":304,"line":377},[1553],{"type":42,"tag":302,"props":1554,"children":1555},{},[1556],{"type":47,"value":1557},"    \u002F\u002F Mark secret as poisoned\n",{"type":42,"tag":302,"props":1559,"children":1560},{"class":304,"line":386},[1561],{"type":42,"tag":302,"props":1562,"children":1563},{},[1564],{"type":47,"value":1565},"    poison(&secret_key, sizeof(secret_key));\n",{"type":42,"tag":302,"props":1567,"children":1568},{"class":304,"line":394},[1569],{"type":42,"tag":302,"props":1570,"children":1571},{"emptyLinePlaceholder":336},[1572],{"type":47,"value":339},{"type":42,"tag":302,"props":1574,"children":1575},{"class":304,"line":403},[1576],{"type":42,"tag":302,"props":1577,"children":1578},{},[1579],{"type":47,"value":1580},"    \u002F\u002F Any branching or memory access dependent on secret_key\n",{"type":42,"tag":302,"props":1582,"children":1583},{"class":304,"line":1340},[1584],{"type":42,"tag":302,"props":1585,"children":1586},{},[1587],{"type":47,"value":1588},"    \u002F\u002F will be reported by Valgrind\n",{"type":42,"tag":302,"props":1590,"children":1591},{"class":304,"line":1349},[1592],{"type":42,"tag":302,"props":1593,"children":1594},{},[1595],{"type":47,"value":1596},"    crypto_operation(secret_key);\n",{"type":42,"tag":302,"props":1598,"children":1599},{"class":304,"line":1358},[1600],{"type":42,"tag":302,"props":1601,"children":1602},{"emptyLinePlaceholder":336},[1603],{"type":47,"value":339},{"type":42,"tag":302,"props":1605,"children":1606},{"class":304,"line":1367},[1607],{"type":42,"tag":302,"props":1608,"children":1609},{},[1610],{"type":47,"value":1611},"    unpoison(&secret_key, sizeof(secret_key));\n",{"type":42,"tag":302,"props":1613,"children":1614},{"class":304,"line":1376},[1615],{"type":42,"tag":302,"props":1616,"children":1617},{},[1618],{"type":47,"value":1290},{"type":42,"tag":50,"props":1620,"children":1621},{},[1622],{"type":47,"value":1623},"Run with Valgrind:",{"type":42,"tag":290,"props":1625,"children":1629},{"className":1626,"code":1627,"language":1628,"meta":295,"style":295},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","valgrind --leak-check=full --track-origins=yes .\u002Fbinary\n","bash",[1630],{"type":42,"tag":298,"props":1631,"children":1632},{"__ignoreMap":295},[1633],{"type":42,"tag":302,"props":1634,"children":1635},{"class":304,"line":305},[1636,1642,1648,1653],{"type":42,"tag":302,"props":1637,"children":1639},{"style":1638},"--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B",[1640],{"type":47,"value":1641},"valgrind",{"type":42,"tag":302,"props":1643,"children":1645},{"style":1644},"--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D",[1646],{"type":47,"value":1647}," --leak-check=full",{"type":42,"tag":302,"props":1649,"children":1650},{"style":1644},[1651],{"type":47,"value":1652}," --track-origins=yes",{"type":42,"tag":302,"props":1654,"children":1655},{"style":1644},[1656],{"type":47,"value":1657}," .\u002Fbinary\n",{"type":42,"tag":50,"props":1659,"children":1660},{},[1661],{"type":42,"tag":212,"props":1662,"children":1663},{},[1664],{"type":47,"value":1398},{"type":42,"tag":204,"props":1666,"children":1667},{},[1668,1673,1678],{"type":42,"tag":208,"props":1669,"children":1670},{},[1671],{"type":47,"value":1672},"Pinpoints exact line of timing leak",{"type":42,"tag":208,"props":1674,"children":1675},{},[1676],{"type":47,"value":1677},"No code instrumentation required",{"type":42,"tag":208,"props":1679,"children":1680},{},[1681],{"type":47,"value":1682},"Tracks secret propagation through execution",{"type":42,"tag":50,"props":1684,"children":1685},{},[1686],{"type":42,"tag":212,"props":1687,"children":1688},{},[1689],{"type":47,"value":1424},{"type":42,"tag":204,"props":1691,"children":1692},{},[1693,1698,1703],{"type":42,"tag":208,"props":1694,"children":1695},{},[1696],{"type":47,"value":1697},"Cannot detect microarchitecture timing differences",{"type":42,"tag":208,"props":1699,"children":1700},{},[1701],{"type":47,"value":1702},"Coverage limited to executed paths",{"type":42,"tag":208,"props":1704,"children":1705},{},[1706],{"type":47,"value":1707},"Performance overhead (runs on synthetic CPU)",{"type":42,"tag":56,"props":1709,"children":1711},{"id":1710},"implementation-guide",[1712],{"type":47,"value":1713},"Implementation Guide",{"type":42,"tag":106,"props":1715,"children":1717},{"id":1716},"phase-1-initial-assessment",[1718],{"type":47,"value":1719},"Phase 1: Initial Assessment",{"type":42,"tag":50,"props":1721,"children":1722},{},[1723],{"type":42,"tag":212,"props":1724,"children":1725},{},[1726],{"type":47,"value":1727},"Identify cryptographic code handling secrets:",{"type":42,"tag":204,"props":1729,"children":1730},{},[1731,1736,1741],{"type":42,"tag":208,"props":1732,"children":1733},{},[1734],{"type":47,"value":1735},"Private keys, exponents, nonces",{"type":42,"tag":208,"props":1737,"children":1738},{},[1739],{"type":47,"value":1740},"Password hashes, authentication tokens",{"type":42,"tag":208,"props":1742,"children":1743},{},[1744],{"type":47,"value":1745},"Encryption\u002Fdecryption operations",{"type":42,"tag":50,"props":1747,"children":1748},{},[1749],{"type":42,"tag":212,"props":1750,"children":1751},{},[1752],{"type":47,"value":1753},"Quick statistical check:",{"type":42,"tag":255,"props":1755,"children":1756},{},[1757,1762,1773],{"type":42,"tag":208,"props":1758,"children":1759},{},[1760],{"type":47,"value":1761},"Write dudect harness for the crypto function",{"type":42,"tag":208,"props":1763,"children":1764},{},[1765,1767],{"type":47,"value":1766},"Run for 5-10 minutes with ",{"type":42,"tag":298,"props":1768,"children":1770},{"className":1769},[],[1771],{"type":47,"value":1772},"timeout 600 .\u002Fct_test",{"type":42,"tag":208,"props":1774,"children":1775},{},[1776],{"type":47,"value":1777},"Monitor t-value: high absolute values indicate leakage",{"type":42,"tag":50,"props":1779,"children":1780},{},[1781,1786,1788,1793],{"type":42,"tag":212,"props":1782,"children":1783},{},[1784],{"type":47,"value":1785},"Tools:",{"type":47,"value":1787}," dudect\n",{"type":42,"tag":212,"props":1789,"children":1790},{},[1791],{"type":47,"value":1792},"Expected time:",{"type":47,"value":1794}," 1-2 hours (harness writing + initial run)",{"type":42,"tag":106,"props":1796,"children":1798},{"id":1797},"phase-2-detailed-analysis",[1799],{"type":47,"value":1800},"Phase 2: Detailed Analysis",{"type":42,"tag":50,"props":1802,"children":1803},{},[1804],{"type":47,"value":1805},"If dudect detects leakage:",{"type":42,"tag":50,"props":1807,"children":1808},{},[1809],{"type":42,"tag":212,"props":1810,"children":1811},{},[1812],{"type":47,"value":1813},"Root cause investigation:",{"type":42,"tag":255,"props":1815,"children":1816},{},[1817,1828,1833,1838],{"type":42,"tag":208,"props":1818,"children":1819},{},[1820,1822],{"type":47,"value":1821},"Mark secret variables with Timecop ",{"type":42,"tag":298,"props":1823,"children":1825},{"className":1824},[],[1826],{"type":47,"value":1827},"poison()",{"type":42,"tag":208,"props":1829,"children":1830},{},[1831],{"type":47,"value":1832},"Run under Valgrind to identify exact line",{"type":42,"tag":208,"props":1834,"children":1835},{},[1836],{"type":47,"value":1837},"Review the four common violation patterns",{"type":42,"tag":208,"props":1839,"children":1840},{},[1841],{"type":47,"value":1842},"Check assembly output for conditional branches",{"type":42,"tag":50,"props":1844,"children":1845},{},[1846,1850,1852,1858],{"type":42,"tag":212,"props":1847,"children":1848},{},[1849],{"type":47,"value":1785},{"type":47,"value":1851}," Timecop, compiler output (",{"type":42,"tag":298,"props":1853,"children":1855},{"className":1854},[],[1856],{"type":47,"value":1857},"objdump -d",{"type":47,"value":1859},")",{"type":42,"tag":106,"props":1861,"children":1863},{"id":1862},"phase-3-remediation",[1864],{"type":47,"value":1865},"Phase 3: Remediation",{"type":42,"tag":50,"props":1867,"children":1868},{},[1869],{"type":42,"tag":212,"props":1870,"children":1871},{},[1872],{"type":47,"value":1873},"Fix the timing leak:",{"type":42,"tag":204,"props":1875,"children":1876},{},[1877,1882,1887,1892],{"type":42,"tag":208,"props":1878,"children":1879},{},[1880],{"type":47,"value":1881},"Replace conditional branches with constant-time selection (bitwise operations)",{"type":42,"tag":208,"props":1883,"children":1884},{},[1885],{"type":47,"value":1886},"Use constant-time comparison functions",{"type":42,"tag":208,"props":1888,"children":1889},{},[1890],{"type":47,"value":1891},"Replace array lookups with constant-time alternatives or masking",{"type":42,"tag":208,"props":1893,"children":1894},{},[1895],{"type":47,"value":1896},"Verify compiler doesn't optimize away constant-time code",{"type":42,"tag":50,"props":1898,"children":1899},{},[1900],{"type":42,"tag":212,"props":1901,"children":1902},{},[1903],{"type":47,"value":1904},"Re-verify:",{"type":42,"tag":255,"props":1906,"children":1907},{},[1908,1913,1918],{"type":42,"tag":208,"props":1909,"children":1910},{},[1911],{"type":47,"value":1912},"Run dudect again for extended period (30+ minutes)",{"type":42,"tag":208,"props":1914,"children":1915},{},[1916],{"type":47,"value":1917},"Test across different compilers and optimization levels",{"type":42,"tag":208,"props":1919,"children":1920},{},[1921],{"type":47,"value":1922},"Test on different CPU architectures",{"type":42,"tag":106,"props":1924,"children":1926},{"id":1925},"phase-4-continuous-monitoring",[1927],{"type":47,"value":1928},"Phase 4: Continuous Monitoring",{"type":42,"tag":50,"props":1930,"children":1931},{},[1932],{"type":42,"tag":212,"props":1933,"children":1934},{},[1935],{"type":47,"value":1936},"Integrate into CI:",{"type":42,"tag":204,"props":1938,"children":1939},{},[1940,1945,1950],{"type":42,"tag":208,"props":1941,"children":1942},{},[1943],{"type":47,"value":1944},"Add dudect tests to test suite",{"type":42,"tag":208,"props":1946,"children":1947},{},[1948],{"type":47,"value":1949},"Run for fixed duration (5-10 minutes in CI)",{"type":42,"tag":208,"props":1951,"children":1952},{},[1953],{"type":47,"value":1954},"Fail build if leakage detected",{"type":42,"tag":50,"props":1956,"children":1957},{},[1958,1960,1964],{"type":47,"value":1959},"See the ",{"type":42,"tag":212,"props":1961,"children":1962},{},[1963],{"type":47,"value":655},{"type":47,"value":1965}," skill for CI integration examples.",{"type":42,"tag":56,"props":1967,"children":1969},{"id":1968},"common-vulnerabilities",[1970],{"type":47,"value":1971},"Common Vulnerabilities",{"type":42,"tag":113,"props":1973,"children":1974},{},[1975,2000],{"type":42,"tag":117,"props":1976,"children":1977},{},[1978],{"type":42,"tag":121,"props":1979,"children":1980},{},[1981,1986,1990,1995],{"type":42,"tag":125,"props":1982,"children":1983},{},[1984],{"type":47,"value":1985},"Vulnerability",{"type":42,"tag":125,"props":1987,"children":1988},{},[1989],{"type":47,"value":134},{"type":42,"tag":125,"props":1991,"children":1992},{},[1993],{"type":47,"value":1994},"Detection",{"type":42,"tag":125,"props":1996,"children":1997},{},[1998],{"type":47,"value":1999},"Severity",{"type":42,"tag":136,"props":2001,"children":2002},{},[2003,2030,2057,2083,2108],{"type":42,"tag":121,"props":2004,"children":2005},{},[2006,2011,2020,2025],{"type":42,"tag":143,"props":2007,"children":2008},{},[2009],{"type":47,"value":2010},"Secret-dependent branch",{"type":42,"tag":143,"props":2012,"children":2013},{},[2014],{"type":42,"tag":298,"props":2015,"children":2017},{"className":2016},[],[2018],{"type":47,"value":2019},"if (secret_bit) { ... }",{"type":42,"tag":143,"props":2021,"children":2022},{},[2023],{"type":47,"value":2024},"dudect, Timecop",{"type":42,"tag":143,"props":2026,"children":2027},{},[2028],{"type":47,"value":2029},"CRITICAL",{"type":42,"tag":121,"props":2031,"children":2032},{},[2033,2038,2047,2052],{"type":42,"tag":143,"props":2034,"children":2035},{},[2036],{"type":47,"value":2037},"Secret-dependent array access",{"type":42,"tag":143,"props":2039,"children":2040},{},[2041],{"type":42,"tag":298,"props":2042,"children":2044},{"className":2043},[],[2045],{"type":47,"value":2046},"table[secret_index]",{"type":42,"tag":143,"props":2048,"children":2049},{},[2050],{"type":47,"value":2051},"Timecop, Binsec",{"type":42,"tag":143,"props":2053,"children":2054},{},[2055],{"type":47,"value":2056},"HIGH",{"type":42,"tag":121,"props":2058,"children":2059},{},[2060,2065,2074,2078],{"type":42,"tag":143,"props":2061,"children":2062},{},[2063],{"type":47,"value":2064},"Variable-time division",{"type":42,"tag":143,"props":2066,"children":2067},{},[2068],{"type":42,"tag":298,"props":2069,"children":2071},{"className":2070},[],[2072],{"type":47,"value":2073},"result = x \u002F secret",{"type":42,"tag":143,"props":2075,"children":2076},{},[2077],{"type":47,"value":1014},{"type":42,"tag":143,"props":2079,"children":2080},{},[2081],{"type":47,"value":2082},"MEDIUM",{"type":42,"tag":121,"props":2084,"children":2085},{},[2086,2091,2100,2104],{"type":42,"tag":143,"props":2087,"children":2088},{},[2089],{"type":47,"value":2090},"Variable-time shift",{"type":42,"tag":143,"props":2092,"children":2093},{},[2094],{"type":42,"tag":298,"props":2095,"children":2097},{"className":2096},[],[2098],{"type":47,"value":2099},"result = x \u003C\u003C secret",{"type":42,"tag":143,"props":2101,"children":2102},{},[2103],{"type":47,"value":1014},{"type":42,"tag":143,"props":2105,"children":2106},{},[2107],{"type":47,"value":2082},{"type":42,"tag":121,"props":2109,"children":2110},{},[2111,2116,2121,2125],{"type":42,"tag":143,"props":2112,"children":2113},{},[2114],{"type":47,"value":2115},"Montgomery reduction leak",{"type":42,"tag":143,"props":2117,"children":2118},{},[2119],{"type":47,"value":2120},"Extra reduction when intermediate > N",{"type":42,"tag":143,"props":2122,"children":2123},{},[2124],{"type":47,"value":655},{"type":42,"tag":143,"props":2126,"children":2127},{},[2128],{"type":47,"value":2056},{"type":42,"tag":106,"props":2130,"children":2132},{"id":2131},"secret-dependent-branch-deep-dive",[2133],{"type":47,"value":2134},"Secret-Dependent Branch: Deep Dive",{"type":42,"tag":50,"props":2136,"children":2137},{},[2138,2143],{"type":42,"tag":212,"props":2139,"children":2140},{},[2141],{"type":47,"value":2142},"The vulnerability:",{"type":47,"value":2144},"\nExecution time differs based on whether branch is taken. Common in optimized modular exponentiation (square-and-multiply).",{"type":42,"tag":50,"props":2146,"children":2147},{},[2148],{"type":42,"tag":212,"props":2149,"children":2150},{},[2151],{"type":47,"value":2152},"How to detect with dudect:",{"type":42,"tag":290,"props":2154,"children":2156},{"className":292,"code":2155,"language":294,"meta":295,"style":295},"uint8_t do_one_computation(uint8_t *data) {\n    uint64_t base = ((uint64_t*)data)[0];\n    uint64_t exponent = ((uint64_t*)data)[1]; \u002F\u002F Secret!\n    return mod_exp(base, exponent, MODULUS);\n}\n\nvoid prepare_inputs(dudect_config_t *c, uint8_t *input_data, uint8_t *classes) {\n    for (size_t i = 0; i \u003C c->number_measurements; i++) {\n        classes[i] = randombit();\n        uint64_t *input = (uint64_t*)(input_data + i * c->chunk_size);\n        input[0] = rand(); \u002F\u002F Random base\n        input[1] = (classes[i] == 0) ? FIXED_EXPONENT : rand(); \u002F\u002F Fixed vs random\n    }\n}\n",[2157],{"type":42,"tag":298,"props":2158,"children":2159},{"__ignoreMap":295},[2160,2167,2175,2183,2191,2198,2205,2212,2219,2226,2234,2242,2250,2257],{"type":42,"tag":302,"props":2161,"children":2162},{"class":304,"line":305},[2163],{"type":42,"tag":302,"props":2164,"children":2165},{},[2166],{"type":47,"value":1274},{"type":42,"tag":302,"props":2168,"children":2169},{"class":304,"line":314},[2170],{"type":42,"tag":302,"props":2171,"children":2172},{},[2173],{"type":47,"value":2174},"    uint64_t base = ((uint64_t*)data)[0];\n",{"type":42,"tag":302,"props":2176,"children":2177},{"class":304,"line":323},[2178],{"type":42,"tag":302,"props":2179,"children":2180},{},[2181],{"type":47,"value":2182},"    uint64_t exponent = ((uint64_t*)data)[1]; \u002F\u002F Secret!\n",{"type":42,"tag":302,"props":2184,"children":2185},{"class":304,"line":332},[2186],{"type":42,"tag":302,"props":2187,"children":2188},{},[2189],{"type":47,"value":2190},"    return mod_exp(base, exponent, MODULUS);\n",{"type":42,"tag":302,"props":2192,"children":2193},{"class":304,"line":342},[2194],{"type":42,"tag":302,"props":2195,"children":2196},{},[2197],{"type":47,"value":1290},{"type":42,"tag":302,"props":2199,"children":2200},{"class":304,"line":351},[2201],{"type":42,"tag":302,"props":2202,"children":2203},{"emptyLinePlaceholder":336},[2204],{"type":47,"value":339},{"type":42,"tag":302,"props":2206,"children":2207},{"class":304,"line":360},[2208],{"type":42,"tag":302,"props":2209,"children":2210},{},[2211],{"type":47,"value":1305},{"type":42,"tag":302,"props":2213,"children":2214},{"class":304,"line":368},[2215],{"type":42,"tag":302,"props":2216,"children":2217},{},[2218],{"type":47,"value":1313},{"type":42,"tag":302,"props":2220,"children":2221},{"class":304,"line":377},[2222],{"type":42,"tag":302,"props":2223,"children":2224},{},[2225],{"type":47,"value":1321},{"type":42,"tag":302,"props":2227,"children":2228},{"class":304,"line":386},[2229],{"type":42,"tag":302,"props":2230,"children":2231},{},[2232],{"type":47,"value":2233},"        uint64_t *input = (uint64_t*)(input_data + i * c->chunk_size);\n",{"type":42,"tag":302,"props":2235,"children":2236},{"class":304,"line":394},[2237],{"type":42,"tag":302,"props":2238,"children":2239},{},[2240],{"type":47,"value":2241},"        input[0] = rand(); \u002F\u002F Random base\n",{"type":42,"tag":302,"props":2243,"children":2244},{"class":304,"line":403},[2245],{"type":42,"tag":302,"props":2246,"children":2247},{},[2248],{"type":47,"value":2249},"        input[1] = (classes[i] == 0) ? FIXED_EXPONENT : rand(); \u002F\u002F Fixed vs random\n",{"type":42,"tag":302,"props":2251,"children":2252},{"class":304,"line":1340},[2253],{"type":42,"tag":302,"props":2254,"children":2255},{},[2256],{"type":47,"value":1382},{"type":42,"tag":302,"props":2258,"children":2259},{"class":304,"line":1349},[2260],{"type":42,"tag":302,"props":2261,"children":2262},{},[2263],{"type":47,"value":1290},{"type":42,"tag":50,"props":2265,"children":2266},{},[2267],{"type":42,"tag":212,"props":2268,"children":2269},{},[2270],{"type":47,"value":2271},"How to detect with Timecop:",{"type":42,"tag":290,"props":2273,"children":2275},{"className":292,"code":2274,"language":294,"meta":295,"style":295},"poison(&exponent, sizeof(exponent));\nresult = mod_exp(base, exponent, modulus);\nunpoison(&exponent, sizeof(exponent));\n",[2276],{"type":42,"tag":298,"props":2277,"children":2278},{"__ignoreMap":295},[2279,2287,2295],{"type":42,"tag":302,"props":2280,"children":2281},{"class":304,"line":305},[2282],{"type":42,"tag":302,"props":2283,"children":2284},{},[2285],{"type":47,"value":2286},"poison(&exponent, sizeof(exponent));\n",{"type":42,"tag":302,"props":2288,"children":2289},{"class":304,"line":314},[2290],{"type":42,"tag":302,"props":2291,"children":2292},{},[2293],{"type":47,"value":2294},"result = mod_exp(base, exponent, modulus);\n",{"type":42,"tag":302,"props":2296,"children":2297},{"class":304,"line":323},[2298],{"type":42,"tag":302,"props":2299,"children":2300},{},[2301],{"type":47,"value":2302},"unpoison(&exponent, sizeof(exponent));\n",{"type":42,"tag":50,"props":2304,"children":2305},{},[2306],{"type":47,"value":2307},"Valgrind will report:",{"type":42,"tag":290,"props":2309,"children":2312},{"className":2310,"code":2311,"language":47},[1131],"Conditional jump or move depends on uninitialised value(s)\n  at 0x40115D: mod_exp (example.c:14)\n",[2313],{"type":42,"tag":298,"props":2314,"children":2315},{"__ignoreMap":295},[2316],{"type":47,"value":2311},{"type":42,"tag":50,"props":2318,"children":2319},{},[2320,2325,2327,2331,2333],{"type":42,"tag":212,"props":2321,"children":2322},{},[2323],{"type":47,"value":2324},"Related skill:",{"type":47,"value":2326}," ",{"type":42,"tag":212,"props":2328,"children":2329},{},[2330],{"type":47,"value":655},{"type":47,"value":2332},", ",{"type":42,"tag":212,"props":2334,"children":2335},{},[2336],{"type":47,"value":676},{"type":42,"tag":56,"props":2338,"children":2340},{"id":2339},"case-studies",[2341],{"type":47,"value":2342},"Case Studies",{"type":42,"tag":106,"props":2344,"children":2346},{"id":2345},"case-study-openssl-rsa-timing-attack",[2347],{"type":47,"value":2348},"Case Study: OpenSSL RSA Timing Attack",{"type":42,"tag":50,"props":2350,"children":2351},{},[2352],{"type":47,"value":2353},"Brumley and Boneh (2005) extracted RSA private keys from OpenSSL over a network. The vulnerability exploited Montgomery multiplication's variable-time reduction step.",{"type":42,"tag":50,"props":2355,"children":2356},{},[2357,2362,2364,2369,2371,2376],{"type":42,"tag":212,"props":2358,"children":2359},{},[2360],{"type":47,"value":2361},"Attack vector:",{"type":47,"value":2363}," Timing differences in modular exponentiation\n",{"type":42,"tag":212,"props":2365,"children":2366},{},[2367],{"type":47,"value":2368},"Detection approach:",{"type":47,"value":2370}," Statistical analysis (precursor to dudect)\n",{"type":42,"tag":212,"props":2372,"children":2373},{},[2374],{"type":47,"value":2375},"Impact:",{"type":47,"value":2377}," Remote key extraction",{"type":42,"tag":50,"props":2379,"children":2380},{},[2381,2386,2388,2393],{"type":42,"tag":212,"props":2382,"children":2383},{},[2384],{"type":47,"value":2385},"Tools used:",{"type":47,"value":2387}," Custom timing measurement\n",{"type":42,"tag":212,"props":2389,"children":2390},{},[2391],{"type":47,"value":2392},"Techniques applied:",{"type":47,"value":2394}," Statistical analysis, chosen-ciphertext queries",{"type":42,"tag":106,"props":2396,"children":2398},{"id":2397},"case-study-kyberslash",[2399],{"type":47,"value":2400},"Case Study: KyberSlash",{"type":42,"tag":50,"props":2402,"children":2403},{},[2404],{"type":47,"value":2405},"Post-quantum algorithm Kyber's reference implementation contained timing vulnerabilities in polynomial operations. Division operations leaked secret coefficients.",{"type":42,"tag":50,"props":2407,"children":2408},{},[2409,2413,2415,2419,2421,2425],{"type":42,"tag":212,"props":2410,"children":2411},{},[2412],{"type":47,"value":2361},{"type":47,"value":2414}," Secret-dependent division timing\n",{"type":42,"tag":212,"props":2416,"children":2417},{},[2418],{"type":47,"value":2368},{"type":47,"value":2420}," Dynamic analysis and statistical testing\n",{"type":42,"tag":212,"props":2422,"children":2423},{},[2424],{"type":47,"value":2375},{"type":47,"value":2426}," Secret key recovery in post-quantum cryptography",{"type":42,"tag":50,"props":2428,"children":2429},{},[2430,2434,2436,2440],{"type":42,"tag":212,"props":2431,"children":2432},{},[2433],{"type":47,"value":2385},{"type":47,"value":2435}," Timing measurement tools\n",{"type":42,"tag":212,"props":2437,"children":2438},{},[2439],{"type":47,"value":2392},{"type":47,"value":2441}," Differential timing analysis",{"type":42,"tag":56,"props":2443,"children":2445},{"id":2444},"advanced-usage",[2446],{"type":47,"value":2447},"Advanced Usage",{"type":42,"tag":106,"props":2449,"children":2451},{"id":2450},"tips-and-tricks",[2452],{"type":47,"value":2453},"Tips and Tricks",{"type":42,"tag":113,"props":2455,"children":2456},{},[2457,2473],{"type":42,"tag":117,"props":2458,"children":2459},{},[2460],{"type":42,"tag":121,"props":2461,"children":2462},{},[2463,2468],{"type":42,"tag":125,"props":2464,"children":2465},{},[2466],{"type":47,"value":2467},"Tip",{"type":42,"tag":125,"props":2469,"children":2470},{},[2471],{"type":47,"value":2472},"Why It Helps",{"type":42,"tag":136,"props":2474,"children":2475},{},[2476,2496,2509,2522,2535,2554],{"type":42,"tag":121,"props":2477,"children":2478},{},[2479,2491],{"type":42,"tag":143,"props":2480,"children":2481},{},[2482,2484,2490],{"type":47,"value":2483},"Pin dudect to isolated CPU core (",{"type":42,"tag":298,"props":2485,"children":2487},{"className":2486},[],[2488],{"type":47,"value":2489},"taskset -c 2",{"type":47,"value":1859},{"type":42,"tag":143,"props":2492,"children":2493},{},[2494],{"type":47,"value":2495},"Reduces OS noise, improves signal detection",{"type":42,"tag":121,"props":2497,"children":2498},{},[2499,2504],{"type":42,"tag":143,"props":2500,"children":2501},{},[2502],{"type":47,"value":2503},"Test multiple compilers (gcc, clang, MSVC)",{"type":42,"tag":143,"props":2505,"children":2506},{},[2507],{"type":47,"value":2508},"Optimizations may introduce or remove leaks",{"type":42,"tag":121,"props":2510,"children":2511},{},[2512,2517],{"type":42,"tag":143,"props":2513,"children":2514},{},[2515],{"type":47,"value":2516},"Run dudect for extended periods (hours)",{"type":42,"tag":143,"props":2518,"children":2519},{},[2520],{"type":47,"value":2521},"Increases statistical confidence",{"type":42,"tag":121,"props":2523,"children":2524},{},[2525,2530],{"type":42,"tag":143,"props":2526,"children":2527},{},[2528],{"type":47,"value":2529},"Minimize non-crypto code in harness",{"type":42,"tag":143,"props":2531,"children":2532},{},[2533],{"type":47,"value":2534},"Reduces noise that masks weak signals",{"type":42,"tag":121,"props":2536,"children":2537},{},[2538,2549],{"type":42,"tag":143,"props":2539,"children":2540},{},[2541,2543,2548],{"type":47,"value":2542},"Check assembly output (",{"type":42,"tag":298,"props":2544,"children":2546},{"className":2545},[],[2547],{"type":47,"value":1857},{"type":47,"value":1859},{"type":42,"tag":143,"props":2550,"children":2551},{},[2552],{"type":47,"value":2553},"Verify compiler didn't introduce branches",{"type":42,"tag":121,"props":2555,"children":2556},{},[2557,2570],{"type":42,"tag":143,"props":2558,"children":2559},{},[2560,2562,2568],{"type":47,"value":2561},"Use ",{"type":42,"tag":298,"props":2563,"children":2565},{"className":2564},[],[2566],{"type":47,"value":2567},"-O3 -march=native",{"type":47,"value":2569}," in testing",{"type":42,"tag":143,"props":2571,"children":2572},{},[2573],{"type":47,"value":2574},"Matches production optimization levels",{"type":42,"tag":106,"props":2576,"children":2578},{"id":2577},"common-mistakes",[2579],{"type":47,"value":2580},"Common Mistakes",{"type":42,"tag":113,"props":2582,"children":2583},{},[2584,2605],{"type":42,"tag":117,"props":2585,"children":2586},{},[2587],{"type":42,"tag":121,"props":2588,"children":2589},{},[2590,2595,2600],{"type":42,"tag":125,"props":2591,"children":2592},{},[2593],{"type":47,"value":2594},"Mistake",{"type":42,"tag":125,"props":2596,"children":2597},{},[2598],{"type":47,"value":2599},"Why It's Wrong",{"type":42,"tag":125,"props":2601,"children":2602},{},[2603],{"type":47,"value":2604},"Correct Approach",{"type":42,"tag":136,"props":2606,"children":2607},{},[2608,2626,2644,2674,2692],{"type":42,"tag":121,"props":2609,"children":2610},{},[2611,2616,2621],{"type":42,"tag":143,"props":2612,"children":2613},{},[2614],{"type":47,"value":2615},"Only testing one input distribution",{"type":42,"tag":143,"props":2617,"children":2618},{},[2619],{"type":47,"value":2620},"May miss leaks visible with other patterns",{"type":42,"tag":143,"props":2622,"children":2623},{},[2624],{"type":47,"value":2625},"Test fixed-vs-random, fixed-vs-fixed-different, etc.",{"type":42,"tag":121,"props":2627,"children":2628},{},[2629,2634,2639],{"type":42,"tag":143,"props":2630,"children":2631},{},[2632],{"type":47,"value":2633},"Short dudect runs (\u003C 1 minute)",{"type":42,"tag":143,"props":2635,"children":2636},{},[2637],{"type":47,"value":2638},"Insufficient measurements for weak signals",{"type":42,"tag":143,"props":2640,"children":2641},{},[2642],{"type":47,"value":2643},"Run 5-10+ minutes, longer for high assurance",{"type":42,"tag":121,"props":2645,"children":2646},{},[2647,2652,2669],{"type":42,"tag":143,"props":2648,"children":2649},{},[2650],{"type":47,"value":2651},"Ignoring compiler optimization levels",{"type":42,"tag":143,"props":2653,"children":2654},{},[2655,2661,2663],{"type":42,"tag":298,"props":2656,"children":2658},{"className":2657},[],[2659],{"type":47,"value":2660},"-O0",{"type":47,"value":2662}," may hide leaks present in ",{"type":42,"tag":298,"props":2664,"children":2666},{"className":2665},[],[2667],{"type":47,"value":2668},"-O3",{"type":42,"tag":143,"props":2670,"children":2671},{},[2672],{"type":47,"value":2673},"Test at production optimization level",{"type":42,"tag":121,"props":2675,"children":2676},{},[2677,2682,2687],{"type":42,"tag":143,"props":2678,"children":2679},{},[2680],{"type":47,"value":2681},"Not testing on target architecture",{"type":42,"tag":143,"props":2683,"children":2684},{},[2685],{"type":47,"value":2686},"x86 vs ARM have different timing characteristics",{"type":42,"tag":143,"props":2688,"children":2689},{},[2690],{"type":47,"value":2691},"Test on deployment platform",{"type":42,"tag":121,"props":2693,"children":2694},{},[2695,2700,2705],{"type":42,"tag":143,"props":2696,"children":2697},{},[2698],{"type":47,"value":2699},"Marking too much as secret in Timecop",{"type":42,"tag":143,"props":2701,"children":2702},{},[2703],{"type":47,"value":2704},"False positives, unclear results",{"type":42,"tag":143,"props":2706,"children":2707},{},[2708],{"type":47,"value":2709},"Mark only true secrets (keys, not public data)",{"type":42,"tag":56,"props":2711,"children":2713},{"id":2712},"related-skills",[2714],{"type":47,"value":2715},"Related Skills",{"type":42,"tag":106,"props":2717,"children":2719},{"id":2718},"tool-skills",[2720],{"type":47,"value":2721},"Tool Skills",{"type":42,"tag":113,"props":2723,"children":2724},{},[2725,2740],{"type":42,"tag":117,"props":2726,"children":2727},{},[2728],{"type":42,"tag":121,"props":2729,"children":2730},{},[2731,2735],{"type":42,"tag":125,"props":2732,"children":2733},{},[2734],{"type":47,"value":613},{"type":42,"tag":125,"props":2736,"children":2737},{},[2738],{"type":47,"value":2739},"Primary Use in Constant-Time Analysis",{"type":42,"tag":136,"props":2741,"children":2742},{},[2743,2758],{"type":42,"tag":121,"props":2744,"children":2745},{},[2746,2753],{"type":42,"tag":143,"props":2747,"children":2748},{},[2749],{"type":42,"tag":212,"props":2750,"children":2751},{},[2752],{"type":47,"value":655},{"type":42,"tag":143,"props":2754,"children":2755},{},[2756],{"type":47,"value":2757},"Statistical detection of timing differences via Welch's t-test",{"type":42,"tag":121,"props":2759,"children":2760},{},[2761,2768],{"type":42,"tag":143,"props":2762,"children":2763},{},[2764],{"type":42,"tag":212,"props":2765,"children":2766},{},[2767],{"type":47,"value":676},{"type":42,"tag":143,"props":2769,"children":2770},{},[2771],{"type":47,"value":2772},"Dynamic tracing to pinpoint exact location of timing leaks",{"type":42,"tag":106,"props":2774,"children":2776},{"id":2775},"technique-skills",[2777],{"type":47,"value":2778},"Technique Skills",{"type":42,"tag":113,"props":2780,"children":2781},{},[2782,2797],{"type":42,"tag":117,"props":2783,"children":2784},{},[2785],{"type":42,"tag":121,"props":2786,"children":2787},{},[2788,2792],{"type":42,"tag":125,"props":2789,"children":2790},{},[2791],{"type":47,"value":613},{"type":42,"tag":125,"props":2793,"children":2794},{},[2795],{"type":47,"value":2796},"When to Apply",{"type":42,"tag":136,"props":2798,"children":2799},{},[2800,2816],{"type":42,"tag":121,"props":2801,"children":2802},{},[2803,2811],{"type":42,"tag":143,"props":2804,"children":2805},{},[2806],{"type":42,"tag":212,"props":2807,"children":2808},{},[2809],{"type":47,"value":2810},"coverage-analysis",{"type":42,"tag":143,"props":2812,"children":2813},{},[2814],{"type":47,"value":2815},"Ensure test inputs exercise all code paths in crypto function",{"type":42,"tag":121,"props":2817,"children":2818},{},[2819,2827],{"type":42,"tag":143,"props":2820,"children":2821},{},[2822],{"type":42,"tag":212,"props":2823,"children":2824},{},[2825],{"type":47,"value":2826},"ci-integration",{"type":42,"tag":143,"props":2828,"children":2829},{},[2830],{"type":47,"value":2831},"Automate constant-time testing in continuous integration pipeline",{"type":42,"tag":106,"props":2833,"children":2835},{"id":2834},"related-domain-skills",[2836],{"type":47,"value":2837},"Related Domain Skills",{"type":42,"tag":113,"props":2839,"children":2840},{},[2841,2856],{"type":42,"tag":117,"props":2842,"children":2843},{},[2844],{"type":42,"tag":121,"props":2845,"children":2846},{},[2847,2851],{"type":42,"tag":125,"props":2848,"children":2849},{},[2850],{"type":47,"value":613},{"type":42,"tag":125,"props":2852,"children":2853},{},[2854],{"type":47,"value":2855},"Relationship",{"type":42,"tag":136,"props":2857,"children":2858},{},[2859,2875],{"type":42,"tag":121,"props":2860,"children":2861},{},[2862,2870],{"type":42,"tag":143,"props":2863,"children":2864},{},[2865],{"type":42,"tag":212,"props":2866,"children":2867},{},[2868],{"type":47,"value":2869},"crypto-testing",{"type":42,"tag":143,"props":2871,"children":2872},{},[2873],{"type":47,"value":2874},"Constant-time analysis is essential component of cryptographic testing",{"type":42,"tag":121,"props":2876,"children":2877},{},[2878,2886],{"type":42,"tag":143,"props":2879,"children":2880},{},[2881],{"type":42,"tag":212,"props":2882,"children":2883},{},[2884],{"type":47,"value":2885},"fuzzing",{"type":42,"tag":143,"props":2887,"children":2888},{},[2889],{"type":47,"value":2890},"Fuzzing crypto code may trigger timing-dependent paths",{"type":42,"tag":56,"props":2892,"children":2894},{"id":2893},"skill-dependency-map",[2895],{"type":47,"value":2896},"Skill Dependency Map",{"type":42,"tag":290,"props":2898,"children":2901},{"className":2899,"code":2900,"language":47},[1131],"                    ┌─────────────────────────┐\n                    │  constant-time-analysis │\n                    │     (this skill)        │\n                    └───────────┬─────────────┘\n                                │\n                ┌───────────────┴───────────────┐\n                │                               │\n                ▼                               ▼\n    ┌───────────────────┐           ┌───────────────────┐\n    │      dudect       │           │     timecop       │\n    │  (statistical)    │           │    (dynamic)      │\n    └────────┬──────────┘           └────────┬──────────┘\n             │                               │\n             └───────────────┬───────────────┘\n                             │\n                             ▼\n              ┌──────────────────────────────┐\n              │   Supporting Techniques      │\n              │ coverage, CI integration     │\n              └──────────────────────────────┘\n",[2902],{"type":42,"tag":298,"props":2903,"children":2904},{"__ignoreMap":295},[2905],{"type":47,"value":2900},{"type":42,"tag":56,"props":2907,"children":2909},{"id":2908},"resources",[2910],{"type":47,"value":2911},"Resources",{"type":42,"tag":106,"props":2913,"children":2915},{"id":2914},"key-external-resources",[2916],{"type":47,"value":2917},"Key External Resources",{"type":42,"tag":50,"props":2919,"children":2920},{},[2921,2931],{"type":42,"tag":212,"props":2922,"children":2923},{},[2924],{"type":42,"tag":68,"props":2925,"children":2928},{"href":2926,"rel":2927},"https:\u002F\u002Fwww.usenix.org\u002Fsystem\u002Ffiles\u002Fsec24fall-prepub-760-fourne.pdf",[72],[2929],{"type":47,"value":2930},"These results must be false: A usability evaluation of constant-time analysis tools",{"type":47,"value":2932},"\nComprehensive usability study of constant-time analysis tools. Key findings: developers struggle with false positives, need better error messages, and benefit from tool integration. Evaluates FaCT, ct-verif, dudect, and Memsan across multiple cryptographic implementations. Recommends improved tooling UX and better documentation.",{"type":42,"tag":50,"props":2934,"children":2935},{},[2936,2946],{"type":42,"tag":212,"props":2937,"children":2938},{},[2939],{"type":42,"tag":68,"props":2940,"children":2943},{"href":2941,"rel":2942},"https:\u002F\u002Fcrocs-muni.github.io\u002Fct-tools\u002F",[72],[2944],{"type":47,"value":2945},"List of constant-time tools - CROCS",{"type":47,"value":2947},"\nCurated catalog of constant-time analysis tools with tutorials. Covers formal tools (ct-verif, FaCT), dynamic tools (Memsan, Timecop), symbolic tools (Binsec), and statistical tools (dudect). Includes practical tutorials for setup and usage.",{"type":42,"tag":50,"props":2949,"children":2950},{},[2951,2960],{"type":42,"tag":212,"props":2952,"children":2953},{},[2954],{"type":42,"tag":68,"props":2955,"children":2957},{"href":70,"rel":2956},[72],[2958],{"type":47,"value":2959},"Paul Kocher: Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems",{"type":47,"value":2961},"\nOriginal 1996 paper introducing timing attacks. Demonstrates attacks on modular exponentiation in RSA and Diffie-Hellman. Essential historical context for understanding timing vulnerabilities.",{"type":42,"tag":50,"props":2963,"children":2964},{},[2965,2974],{"type":42,"tag":212,"props":2966,"children":2967},{},[2968],{"type":42,"tag":68,"props":2969,"children":2971},{"href":89,"rel":2970},[72],[2972],{"type":47,"value":2973},"Remote Timing Attacks are Practical (Brumley & Boneh)",{"type":47,"value":2975},"\nDemonstrates practical remote timing attacks against OpenSSL. Shows network-level timing differences are sufficient to extract RSA keys. Proves timing attacks work in realistic network conditions.",{"type":42,"tag":50,"props":2977,"children":2978},{},[2979,2988],{"type":42,"tag":212,"props":2980,"children":2981},{},[2982],{"type":42,"tag":68,"props":2983,"children":2985},{"href":432,"rel":2984},[72],[2986],{"type":47,"value":2987},"Cache-timing attacks on AES",{"type":47,"value":2989},"\nShows AES implementations using lookup tables are vulnerable to cache-timing attacks. Demonstrates practical attacks extracting AES keys via cache timing side channels.",{"type":42,"tag":50,"props":2991,"children":2992},{},[2993,3002],{"type":42,"tag":212,"props":2994,"children":2995},{},[2996],{"type":42,"tag":68,"props":2997,"children":2999},{"href":98,"rel":2998},[72],[3000],{"type":47,"value":3001},"KyberSlash: Division Timings Leak Secrets",{"type":47,"value":3003},"\nRecent discovery of timing vulnerabilities in Kyber (NIST post-quantum standard). Shows division operations leak secret coefficients. Highlights that constant-time issues persist even in modern post-quantum cryptography.",{"type":42,"tag":106,"props":3005,"children":3007},{"id":3006},"video-resources",[3008],{"type":47,"value":3009},"Video Resources",{"type":42,"tag":204,"props":3011,"children":3012},{},[3013],{"type":42,"tag":208,"props":3014,"children":3015},{},[3016,3023],{"type":42,"tag":68,"props":3017,"children":3020},{"href":3018,"rel":3019},"https:\u002F\u002Fwww.youtube.com\u002Fwatch?v=vW6wqTzfz5g",[72],[3021],{"type":47,"value":3022},"Trail of Bits: Constant-Time Programming",{"type":47,"value":3024}," - Overview of constant-time programming principles and tools",{"type":42,"tag":3026,"props":3027,"children":3028},"style",{},[3029],{"type":47,"value":3030},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"items":3032,"total":3185},[3033,3049,3059,3077,3092,3105,3117,3127,3140,3151,3163,3174],{"slug":3034,"name":3034,"fn":3035,"description":3036,"org":3037,"tags":3038,"stars":23,"repoUrl":24,"updatedAt":3048},"address-sanitizer","detect memory errors during fuzzing","AddressSanitizer detects memory errors during fuzzing. Use when fuzzing C\u002FC++ code to find buffer overflows and use-after-free bugs.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3039,3041,3044,3045],{"name":3040,"slug":294,"type":16},"C#",{"name":3042,"slug":3043,"type":16},"Debugging","debugging",{"name":14,"slug":15,"type":16},{"name":3046,"slug":3047,"type":16},"Testing","testing","2026-07-17T06:05:14.925095",{"slug":3050,"name":3050,"fn":3051,"description":3052,"org":3053,"tags":3054,"stars":23,"repoUrl":24,"updatedAt":3058},"aflpp","perform multi-core fuzzing of C\u002FC++ projects","AFL++ is a fork of AFL with better fuzzing performance and advanced features. Use for multi-core fuzzing of C\u002FC++ projects.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3055,3056,3057],{"name":3040,"slug":294,"type":16},{"name":14,"slug":15,"type":16},{"name":3046,"slug":3047,"type":16},"2026-07-17T06:05:12.433192",{"slug":3060,"name":3060,"fn":3061,"description":3062,"org":3063,"tags":3064,"stars":23,"repoUrl":24,"updatedAt":3076},"agentic-actions-auditor","audit GitHub Actions for security vulnerabilities","Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI\u002FCD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI\u002FCD pipeline security for prompt injection risks, or evaluating agentic action configurations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3065,3068,3071,3072,3075],{"name":3066,"slug":3067,"type":16},"Agents","agents",{"name":3069,"slug":3070,"type":16},"CI\u002FCD","ci-cd",{"name":21,"slug":22,"type":16},{"name":3073,"slug":3074,"type":16},"GitHub Actions","github-actions",{"name":14,"slug":15,"type":16},"2026-07-18T05:47:48.564744",{"slug":3078,"name":3078,"fn":3079,"description":3080,"org":3081,"tags":3082,"stars":23,"repoUrl":24,"updatedAt":3091},"algorand-vulnerability-scanner","scan Algorand smart contracts for vulnerabilities","Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL\u002FPyTeal).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3083,3086,3087,3088],{"name":3084,"slug":3085,"type":16},"Audit","audit",{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":3089,"slug":3090,"type":16},"Smart Contracts","smart-contracts","2026-07-18T05:47:43.989063",{"slug":3093,"name":3093,"fn":3094,"description":3095,"org":3096,"tags":3097,"stars":23,"repoUrl":24,"updatedAt":3104},"ask-questions-if-underspecified","clarify requirements before implementation","Clarify requirements before implementing. Use when serious doubts arise.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3098,3101],{"name":3099,"slug":3100,"type":16},"Engineering","engineering",{"name":3102,"slug":3103,"type":16},"Productivity","productivity","2026-07-17T06:05:33.543262",{"slug":3106,"name":3106,"fn":3107,"description":3108,"org":3109,"tags":3110,"stars":23,"repoUrl":24,"updatedAt":3116},"atheris","fuzz Python code with Atheris","Atheris is a coverage-guided Python fuzzer based on libFuzzer. Use for fuzzing pure Python code and Python C extensions.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3111,3114,3115],{"name":3112,"slug":3113,"type":16},"Python","python",{"name":14,"slug":15,"type":16},{"name":3046,"slug":3047,"type":16},"2026-07-17T06:05:14.575191",{"slug":3118,"name":3118,"fn":3119,"description":3120,"org":3121,"tags":3122,"stars":23,"repoUrl":24,"updatedAt":3126},"audit-augmentation","augment code graphs with audit findings","Augments Trailmark code graphs with external audit findings from SARIF static analysis results, weAudit annotation files, and version-gated Trailmark 0.4.x binary-analysis graph exports. Maps findings to graph nodes by file and line overlap, creates severity-based subgraphs, and enables cross-referencing findings with pre-analysis data (blast radius, taint, etc.). Use when projecting SARIF results onto a code graph, overlaying weAudit annotations, importing binary graph findings, cross-referencing Semgrep, CodeQL, or binary-analysis findings with call graph data, or visualizing audit findings in the context of code structure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3123,3124,3125],{"name":3084,"slug":3085,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},"2026-08-01T05:44:54.920542",{"slug":3128,"name":3128,"fn":3129,"description":3130,"org":3131,"tags":3132,"stars":23,"repoUrl":24,"updatedAt":3139},"audit-context-building","build architectural context for code analysis","Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3133,3136,3137,3138],{"name":3134,"slug":3135,"type":16},"Architecture","architecture",{"name":3084,"slug":3085,"type":16},{"name":21,"slug":22,"type":16},{"name":3099,"slug":3100,"type":16},"2026-07-18T05:47:40.122449",{"slug":3141,"name":3141,"fn":3142,"description":3143,"org":3144,"tags":3145,"stars":23,"repoUrl":24,"updatedAt":3150},"audit-prep-assistant","prepare codebases for security audits","Prepares codebases for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates documentation (flowcharts, user stories, inline comments).",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3146,3147,3148,3149],{"name":3084,"slug":3085,"type":16},{"name":21,"slug":22,"type":16},{"name":3099,"slug":3100,"type":16},{"name":14,"slug":15,"type":16},"2026-07-18T05:47:39.210985",{"slug":3152,"name":3152,"fn":3153,"description":3154,"org":3155,"tags":3156,"stars":23,"repoUrl":24,"updatedAt":3162},"burpsuite-project-parser","parse Burp Suite project files","Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit findings, dumping proxy history or site map data, or analyzing HTTP traffic captured in a Burp project.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3157,3158,3161],{"name":3084,"slug":3085,"type":16},{"name":3159,"slug":3160,"type":16},"CLI","cli",{"name":14,"slug":15,"type":16},"2026-07-17T06:05:33.198077",{"slug":3164,"name":3164,"fn":3165,"description":3166,"org":3167,"tags":3168,"stars":23,"repoUrl":24,"updatedAt":3173},"c-review","audit C and C++ code","Performs comprehensive C\u002FC++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C\u002FC++ applications, reviewing daemons or services for memory safety, or hunting integer overflow \u002F use-after-free \u002F race conditions in userspace code.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3169,3170,3171,3172],{"name":3084,"slug":3085,"type":16},{"name":3040,"slug":294,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},"2026-07-17T06:05:11.333374",{"slug":3175,"name":3175,"fn":3176,"description":3177,"org":3178,"tags":3179,"stars":23,"repoUrl":24,"updatedAt":3184},"cairo-vulnerability-scanner","scan Cairo and StarkNet contracts for vulnerabilities","Scans Cairo\u002FStarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3180,3181,3182,3183],{"name":3084,"slug":3085,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":3089,"slug":3090,"type":16},"2026-07-18T05:47:42.84568",111,{"items":3187,"total":3233},[3188,3195,3201,3209,3216,3221,3227],{"slug":3034,"name":3034,"fn":3035,"description":3036,"org":3189,"tags":3190,"stars":23,"repoUrl":24,"updatedAt":3048},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3191,3192,3193,3194],{"name":3040,"slug":294,"type":16},{"name":3042,"slug":3043,"type":16},{"name":14,"slug":15,"type":16},{"name":3046,"slug":3047,"type":16},{"slug":3050,"name":3050,"fn":3051,"description":3052,"org":3196,"tags":3197,"stars":23,"repoUrl":24,"updatedAt":3058},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3198,3199,3200],{"name":3040,"slug":294,"type":16},{"name":14,"slug":15,"type":16},{"name":3046,"slug":3047,"type":16},{"slug":3060,"name":3060,"fn":3061,"description":3062,"org":3202,"tags":3203,"stars":23,"repoUrl":24,"updatedAt":3076},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3204,3205,3206,3207,3208],{"name":3066,"slug":3067,"type":16},{"name":3069,"slug":3070,"type":16},{"name":21,"slug":22,"type":16},{"name":3073,"slug":3074,"type":16},{"name":14,"slug":15,"type":16},{"slug":3078,"name":3078,"fn":3079,"description":3080,"org":3210,"tags":3211,"stars":23,"repoUrl":24,"updatedAt":3091},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3212,3213,3214,3215],{"name":3084,"slug":3085,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},{"name":3089,"slug":3090,"type":16},{"slug":3093,"name":3093,"fn":3094,"description":3095,"org":3217,"tags":3218,"stars":23,"repoUrl":24,"updatedAt":3104},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3219,3220],{"name":3099,"slug":3100,"type":16},{"name":3102,"slug":3103,"type":16},{"slug":3106,"name":3106,"fn":3107,"description":3108,"org":3222,"tags":3223,"stars":23,"repoUrl":24,"updatedAt":3116},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3224,3225,3226],{"name":3112,"slug":3113,"type":16},{"name":14,"slug":15,"type":16},{"name":3046,"slug":3047,"type":16},{"slug":3118,"name":3118,"fn":3119,"description":3120,"org":3228,"tags":3229,"stars":23,"repoUrl":24,"updatedAt":3126},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[3230,3231,3232],{"name":3084,"slug":3085,"type":16},{"name":21,"slug":22,"type":16},{"name":14,"slug":15,"type":16},77]