Dude, is my code constant time? (2016)

Some timing countermeasures are just baked into the code, without a test harness that could provide some degree of confidence that the countermeasure is sound. How do we test if a piece of code runs in constant time or not? Not easy. I released dudect: a small tool to assess whether a piece of code runs in constant time or not. The approach is easy and fundamentally different from previous approaches: run the piece of code under test with different inputs, measure its execution time and apply statistics. Let's test the timing variability of two AES128 implementations in my laptop. o. The procedure starts by measuring the execution time for two input classes corresponding to two different input values. This is bananas and means that the two distributions are different, that is, there is information leakage on the execution time.