A practical evaluation of automated tools designed to detect timing leaks and side-channel vulnerabilities in production cryptographic binaries.
Static analysis tools inspect compiled assembly to verify the absence of variable-time instructions and conditional branches, while statistical dynamic tools (such as dudect) collect millions of execution timing samples and apply Welch's t-test to detect subtle microarchitectural variance in real hardware environments.
Step-by-step instructions on setting up dudect harnesses for ML-KEM, including test vector generation, CPU frequency governor pinning, thermal throttling suppression, and sample size configuration to achieve detection sensitivity below 1 CPU cycle.
Analyzing statistical outliers, hardware interrupt interference, and cache warmup anomalies to distinguish genuine microarchitectural timing leaks from measurement artifacts.