sorryfreeLast reviewed 2026-09-13
Index › Glossary › Constant-time verification

Constant-time verification

Direct answerProving that a program's control flow and memory access pattern do not depend on secret data, so timing and cache side channels cannot leak keys.

In more detail

Jasmin checks it in the compiler; HACL* proves secret independence in F*; AWS-LC's assembly is verified constant-time. Functional correctness proofs do not imply it: the KyberSlash timing bugs were in code that computed the right answer.

Frameworks that address it

Jasmin and libjade, HACL*, Vale and EverCrypt.

Circuit soundness, Circuit completeness, Underconstrained circuit, Overconstrained circuit, Symbolic vs computational model, Specification gap, Trusted computing base and verification boundary, Proof assistant vs SMT-based verifier, Bounded model checking, Equivalence checking, Refinement, Arithmetization (R1CS, PLONKish, AIR), Extraction (code to model), Witness generation vs constraints

Getting help

Firms on this index that handle this in practice: zkSecurity, Galois, Veridise, Nethermind (Formal Verification team).

Last reviewed 2026-09-13 by the sorryfree editors. Machine-readable: data.json · summary.txt