Constant-Time Cryptography
Constant-time implementations make execution time and memory access pattern independent of secret values, eliminating the timing side channel that leaks keys one bit at a time through measurement.
Definition
A constant-time cryptographic implementation is one whose execution time, branch behavior, and memory access addresses do not depend on secret inputs, so an attacker measuring timing or cache behavior cannot extract information about the key or plaintext.
Context and scope
Applied in cryptographic library implementations, comparison of secrets, and any code path where a timing or cache side channel can distinguish secret-dependent behavior.
Common misconceptions
- Constant-time code is just uniform loop length — branches on secret values and secret-indexed memory access leak even with fixed length
- Modern CPUs make timing attacks impractical — microarchitectural side channels (cache, branch predictor) leak secret-dependent access patterns on any CPU
Anti-patterns
- Using a early-return string comparison for token equality, leaking the matching prefix length through timing
- Writing a constant-time compare that the compiler optimizes back to an early return, defeating the intent at compile time
Related concepts
Authoritative source
https://www.chosenplaintext.ca/articles/beginners-guide-constant-time-cryptography
What it is
A constant-time cryptographic implementation is one whose execution time, branch behavior, and memory access addresses do not depend on secret inputs, so an attacker measuring timing or cache behavior cannot extract information about the key or plaintext. Applied in cryptographic library implementations, comparison of secrets, and any code path where a timing or cache side channel can distinguish secret-dependent behavior. The threat model determines which controls apply: preventive controls block exploits, detective controls surface violations, and corrective controls restore integrity after an incident.
How it works
Effective implementations layer controls so that no single bypass compromises the asset. Verification happens at trust boundaries, not just at the perimeter. Cryptographic primitives are selected for the concrete property needed — unforgeability, indistinguishability, or non-malleability — and never composed ad hoc. Failure modes fail closed: a verification error denies rather than allows.
When to enforce and pitfalls
Enforce wherever an attacker can influence input that crosses a trust boundary. Common pitfalls include treating obfuscation as a control, relying on secrecy of the algorithm rather than the key, and auditing the happy path while ignoring error-handling branches where bypasses often hide. Rate-limit and log every verification attempt so brute-force and oracle attacks become visible.