Constant time programming patterns is the primary defense against timing attacks on cryptographic implementations, yet what "constant time" means varies across academia and industry. This work systematizes constant time models and their evolution, identifies a recurring gap between what models protect and what specifications assume, and distills an offensive methodology for discovering timing vulnerabilities that originate outside the cryptographic primitive boundary. Applying this methodology, we locate a specification-level vulnerability related to private key loading, and confirm the leak in both OpenSSL and BoringSSL. Counterintuitively, BoringSSL's per-observation signal is several orders of magnitude stronger than OpenSSL's, despite an explicitly stricter threat model.

翻译：常时编程模式是对抗密码学实现中时序攻击的主要防御手段，然而“常时”的含义在学术界与工业界之间存在差异。本文系统化了常时模型及其演变过程，识别了模型所保护内容与规范所假设内容之间反复出现的差距，并提炼出一种攻击性方法论，用于发现源于密码学原语边界之外的时序漏洞。应用该方法论，我们定位了一个与私钥加载相关的规范级漏洞，并在OpenSSL和BoringSSL中确认了信息泄露。反直觉的是，尽管BoringSSL的威胁模型更为严格，但其每次观测的信号强度比OpenSSL高出数个数量级。