SECURITY REVIEW / Trail of Bits
Constant-time analysis
Routes a timing review by language and says when not to use the analyzer.
“Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.”
01 / THE REASONING
Why this made the selection.
- The description names secret-dependent branches and division on secrets.
- Headings include When NOT to Use and Language Routing.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md
- LICENSE
Our findings
- Headings include Interpreting Results.
- The definition explicitly documents no-dataflow triage, warning-only detector families and configuration-specific results, plus optimized-away private Rust functions as a coverage caveat.
- A finding that cannot be traced to a secret is not a finding and must be said explicitly rather than dropped.
Not established by this review
- The skill was not executed inside a host agent.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
/plugin marketplace add trailofbits/skillsCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Claude Code: add the marketplace with /plugin marketplace add trailofbits/skills, then install the constant-time-analysis plugin from /plugin menu. The plugin also carries the ct_analyzer package and a /ct-check command.
- Codex: the README documents codex plugin marketplace add trailofbits/skills, then codex plugin add <plugin-name>@trailofbits.
- Install uv and the toolchain for each language you analyse. The SKILL.md prerequisites table lists them.
Before you start
- uv, and Python 3.10 or later for ct_analyzer (pyproject.toml)
- The compiler or runtime for each target language
- The cryptographic code under review
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
- Skill definition ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md
Supports: Workflow and stated scope
- Repository licence ↗Checked
https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE
Supports: Redistribution terms