SoK: The Constant Time Model
For cryptographic library developers and security researchers, this work highlights the need to align constant-time guarantees with specification-level assumptions to prevent timing attacks.
This paper systematizes constant time models, identifies a gap between model protections and specification assumptions, and develops an offensive methodology that discovered a specification-level vulnerability in private key loading, confirmed in OpenSSL and BoringSSL with BoringSSL showing several orders of magnitude stronger leakage despite a stricter threat model.
Constant time programming patterns is the primary defense against timing attacks on cryptographic implementations, yet what "constant time" means varies across academia and industry. This work systematizes constant time models and their evolution, identifies a recurring gap between what models protect and what specifications assume, and distills an offensive methodology for discovering timing vulnerabilities that originate outside the cryptographic primitive boundary. Applying this methodology, we locate a specification-level vulnerability related to private key loading, and confirm the leak in both OpenSSL and BoringSSL. Counterintuitively, BoringSSL's per-observation signal is several orders of magnitude stronger than OpenSSL's, despite an explicitly stricter threat model.