constant-time-testing

An agent skill by trailofbits, from trailofbits/skills. Tags: analysis, crypto, security, testing.

What it does

Measures timing side channels in cryptographic implementations by running them, using dudect for statistical analysis and Timecop over Valgrind for dynamic tracing. Covers the formal, symbolic, dynamic, and statistical tool categories and how to read a result. Use when testing whether a running implementation is constant-time, measuring timing variance on a compiled binary, or investigating a suspected timing attack. Not for statically inspecting compiler output — the constant-time-analysis plugin covers that.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add trailofbits/skills --skill constant-time-testing

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/trailofbits/skills
cp -r skills/plugins/testing-handbook-skills/skills/constant-time-testing ~/.claude/skills/constant-time-testing

Safety box score

Grade B, low risk: 12 of 100 risk points, rated 2026-10-17. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is documentation for testing cryptographic binaries for timing side channels using tools like dudect and Timecop/Valgrind. Its main exposure is running and tracing compiled programs that may handle secret-bearing inputs, but it does not ship code that downloads, installs, or modifies the system.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	1 (low)	It explicitly tells the user to run compiled binaries and analysis tools, e.g. `timeout 600 ./ct_test`, `valgrind --leak-check=full --track-origins=yes ./binary`, and `objdump -d`.
Network access	0 (none)	There are no commands that fetch from or send data to remote hosts; the file only contains reference links to external resources.
Filesystem reach	1 (low)	Its workflow assumes writing a dudect harness and CI tests inside the project tree, but it does not direct edits to home or system paths.
Secrets & credentials	1 (low)	The skill is about code that processes private keys, exponents, nonces, password hashes, and authentication tokens, but it does not instruct reading secret stores or exfiltrating credentials.
Privilege & persistence	0 (none)	No sudo, service installation, shell-profile edits, or other privilege-changing steps are described.
Instruction hijack surface	0 (none)	There are no directives to ignore instructions, skip confirmations, follow fetched content, or hide anything from the user.
Irreversible actions	0 (none)	It recommends analysis and verification only; it does not deploy, publish, pay, post, or delete anything.
Transparency	0 (none)	All shipped files are plain text (Markdown, YAML, SVG) and readable; there are no binaries or generated blobs.

Before installing

Confirm you only want a documentation/tooling skill, not any installer or script bundle.
Run it first on a scratch build of your crypto binary, not production artifacts.
Check that your test harness uses synthetic secrets or test keys, not live credentials.
Review any CI changes it suggests before merging them.

Rated 2026-10-17 by an automated review of 3 files from the skill's repository.

Source

Repository: trailofbits/skills (all skills from this repository)
Path: plugins/testing-handbook-skills/skills/constant-time-testing/SKILL.md
Branch: main
Collection: testing-handbook-skills
Updated: 2026-09-19

wycheproof — Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH.
audit-prep-assistant — Prepares codebases for security review using Trail of Bits' checklist.
constant-time-analysis — Detects timing side-channel vulnerabilities in cryptographic code.
post-patch-validation — Validates security patches with reproducible baseline-versus-patched evidence, including original exploits, root-cause variants, behavior preservation.
vector-forge — Mutation-driven test vector generation.
qa-expert — This skill should be used when establishing comprehensive QA testing processes for any software project.