Constant Time Analysis

A portable tool for detecting timing side-channel vulnerabilities in compiled cryptographic code. Analyzes assembly output from multiple compilers and architectures to detect instructions that could leak secret data through execution timing.

Background

Timing side-channel attacks exploit variations in execution time to extract secret information from cryptographic implementations. Common sources include:

• Hardware division (DIV, IDIV): Execution time varies based on operand values
• Floating-point operations (FDIV, FSQRT): Variable latency based on inputs
• Conditional branches: Different execution paths have different timing

The infamous KyberSlash attack demonstrated how division instructions in post-quantum cryptographic implementations could be exploited to recover secret keys.

Features

• Multi-language support: C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, Ruby
• Multi-architecture support: x86_64, ARM64, ARM, RISC-V, PowerPC, s390x, i386
• Multi-compiler support: GCC, Clang, Go compiler, Rustc, Swiftc
• Bytecode support: Java/Kotlin (JVM), C# (CIL), PHP (VLD/opcache), JavaScript/TypeScript (V8 bytecode), Python (dis), Ruby (YARV)
• Optimization-level testing: Test across O0-O3, Os, Oz
• Multiple output formats: Text, JSON, GitHub Actions annotations
• Cross-compilation: Analyze code for different target architectures

Quick Start

# Install
uv tool install .

# Analyze a C file
ct-analyzer crypto.c

Components

The rest of this README documents ct-analyzer, the CLI. Inside Claude Code the plugin offers two more entry points:

Usage

Basic Analysis

ct-analyzer <source_file>

Options

Examples

# Test with different optimization levels
ct-analyzer --opt-level O0 crypto.c
ct-analyzer --opt-level O3 crypto.c

# Cross-compile for ARM64
ct-analyzer --arch arm64 crypto.c

# Include conditional branch warnings
ct-analyzer --warnings crypto.c

# Analyze specific functions
ct-analyzer --func 'decompose|sign' crypto.c

# JSON output for CI
ct-analyzer --json crypto.c

# Analyze Go code
ct-analyzer crypto.go
…

Detected Vulnerabilities

Error-Level (Must Fix)

Warning-Level (Review Needed)

Conditional branches that may leak timing if condition depends on secret data:

• x86: JE, JNE, JZ, JNZ, JA, JB, JG, JL, etc.
• ARM: BEQ, BNE, CBZ, CBNZ, TBZ, TBNZ
• RISC-V: BEQ, BNE, BLT, BGE

Scripting Language Support

PHP Analysis

PHP analysis uses either the VLD extension (recommended) or opcache debug output:

Detected PHP Vulnerabilities:

Installation:

# Install VLD extension (recommended)
# Query latest version from PECL. POSIX ERE, not `grep -P`: PCRE mode is a GNU
# extension that stock macOS grep rejects, leaving VLD_VERSION empty.
VLD_VERSION=$(curl -fsS https://pecl.php.net/package/vld |
  grep -oE 'vld-[0-9]+(\.[0-9]+)*\.tgz' | head -1 | sed -E 's/^vld-//; s/\.tgz$//')
[ -n "$VLD_VERSION" ] && pecl install channel://pecl.php.net/vld-${VLD_VERSION}

# Or build from source (if PECL fails)
git clone https://github.com/derickr/vld.git && cd vld
phpize && ./configure && make && sudo make install

# Or use opcache (built-in, fallback)
# Enabled by default in PHP 7+

JavaScript/TypeScript Analysis

JavaScript analysis uses V8 bytecode via Node.js --print-bytecode. TypeScript files are automatically transpiled first.

Detected JS Vulnerabilities:

Requirements:

# Node.js required
node --version

# TypeScript compiler (optional, for .ts files)
npm install -g typescript

Python Analysis

Python analysis uses the built-in dis module to analyze CPython bytecode.

Detected Python Vulnerabilities:

Requirements:

# Python 3.x required (built-in dis module)
uv run python --version

Ruby Analysis

Ruby analysis uses YARV (Yet Another Ruby VM) bytecode via ruby --dump=insns.

Detected Ruby Vulnerabilities:

Requirements:

# Ruby required (YARV is standard since Ruby 1.9)
ruby --version

Example Output

============================================================
Constant-Time Analysis Report
============================================================
Source: decompose.c
Architecture: arm64
Compiler: clang
Optimization: O2
Functions analyzed: 4
Instructions analyzed: 88

VIOLATIONS FOUND:
----------------------------------------
[ERROR] SDIV
  Function: decompose_vulnerable
  Reason: SDIV has early termination optimization; execution time depends on operand values

[ERROR] SDIV
  Function: use_hint_vulnerable
…