constant-time-analysis

仓库创建 2026年1月15日最近提交 6 天前SkillHot 收录 20 天前

▸ 精选理由

适合审计或实现常量时间加密代码，自动定位危险分支与运算。

这个 Skill 做什么

检测密码学代码中因执行时间差异泄露秘密的定时侧信道问题。

帮你找出密码学代码里会通过执行时间泄露秘钥的 timing side-channel 问题。常在写或审核 crypto 代码、遇到 secret-dependent 分支或对 constant-time 实现有疑问时用到。支持多种语言，能定位除法、分支等危险操作并给出改成常时执行（constant-time）的建议。

▸ 展开 SKILL.md 英文原文

Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

开发编程侧信道密码学静态分析通用

6.3k

Stars

542

Forks

仓库内 Skill

+270

7 日增星

安装 / 使用

给你的 Agent 一句话（通用）

帮我安装这个 skill：https://raw.githubusercontent.com/trailofbits/skills/main/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md

或 curl 直取 SKILL.md

curl -fsSL "https://raw.githubusercontent.com/trailofbits/skills/main/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md"

SKILL.MD 节选查看完整文件 ↗

# Constant-Time Analysis

Analyze cryptographic code to detect operations that leak secret data through execution timing variations.

## When to Use

```text
User writing crypto code? ──yes──> Use this skill
         │
         no
         │
         v
User asking about timing attacks? ──yes──> Use this skill
         │
         no
         │
         v
Code handles secret keys/tokens? ──yes──> Use this skill
         │
         no
         │
         v
Skip this skill
```

**Concrete triggers:**

- User implements signature, encryption, or key derivation
- Code contains `/` or `%` operators on secret-derived values
- User mentions "constant-time", "timing attack", "side-channel", "KyberSlas

via SKILL·HOT · 数据来自 GitHub 公开信息 · 原文版权归作者所有