Constant-time implementation

A constant-time implementation is code whose execution time and memory-access pattern do not depend on secret values such as keys or plaintext. It is the standard defense against timing and other side-channel attacks, which recover secrets by measuring how long an operation takes, which cache lines it touches, or how much power it draws, rather than by breaking the underlying mathematics.

#How it is achieved

Constant-time code avoids secret-dependent branches, secret-dependent array indices, and variable-time instructions such as some division and modular-reduction paths. Comparisons and conditional selections are rewritten as arithmetic over the whole input so that control flow stays fixed. Paul Kocher's 1996 timing attacks on RSA and Diffie-Hellman first made the risk concrete, and the discipline is now standard in libraries such as the one documented by BearSSL. Post-quantum schemes carry their own hazards: rejection sampling in ML-DSA and the decapsulation check in ML-KEM must be coded carefully, and constant-time behavior is equally required when implementing AES and other primitives.