---
_id: '65534'
abstract:
- lang: eng
  text: Cryptography secures our online interactions, transactions, and trust. To
    achieve this goal, not only do the cryptographic primitives and protocols need
    to be secure in theory, they also need to be securely implemented by cryptographic
    library developers in practice. However, implementing cryptographic algorithms
    securely is challenging, even for skilled professionals, which can lead to vulnerable
    implementations, especially to side-channel attacks. For timing attacks, a severe
    class of side-channel attacks, there exist a multitude of tools that are supposed
    to help cryptographic library developers assess whether their code is vulnerable
    to timing attacks. Previous work has established that despite an interest in writing
    constant-time code, cryptographic library developers do not routinely use these
    tools due to their general lack of usability. However, the precise factors affecting
    the usability of these tools remain unexplored. While many of the tools are developed
    in an academic context, we believe that it is worth exploring the factors that
    contribute to or hinder their effective use by cryptographic library developers
    [61]. To assess what contributes to and detracts from usability of tools that
    verify constant-timeness (CT), we conducted a two-part usability study with 24
    (post) graduate student participants on 6 tools across diverse tasks that approximate
    real-world use cases for cryptographic library developers. We find that all studied
    tools are affected by similar usability issues to varying degrees, with no tool
    excelling in usability, and usability issues preventing their effective use. Based
    on our results, we recommend that effective tools for verifying CT need usable
    documentation, simple installation, easy to adapt examples, clear output corresponding
    to CT violations, and minimal noninvasive code markup. We contribute first steps
    to achieving these with limited academic resources, with our documentation, examples,
    and installation scripts(1).
author:
- first_name: M
  full_name: Fourn , M
  last_name: 'Fourn '
- first_name: DD
  full_name: Braga, DD
  last_name: Braga
- first_name: J
  full_name: Jancar, J
  last_name: Jancar
- first_name: M
  full_name: Sabt, M
  last_name: Sabt
- first_name: P
  full_name: Schwabe, P
  last_name: Schwabe
- first_name: G
  full_name: Barthe, G
  last_name: Barthe
- first_name: PA
  full_name: Fouque, PA
  last_name: Fouque
- first_name: Y
  full_name: Acar, Y
  last_name: Acar
citation:
  ama: 'Fourn  M, Braga D, Jancar J, et al. “These results must be false”: A usability
    evaluation of constant-time analysis tools. Published online 2024.'
  apa: 'Fourn , M., Braga, D., Jancar, J., Sabt, M., Schwabe, P., Barthe, G., Fouque,
    P., &#38; Acar, Y. (2024). <i>“These results must be false”: A usability evaluation
    of constant-time analysis tools</i>.'
  bibtex: '@article{Fourn _Braga_Jancar_Sabt_Schwabe_Barthe_Fouque_Acar_2024, place={Berkeley},
    title={“These results must be false”: A usability evaluation of constant-time
    analysis tools}, publisher={Usenix Assoc}, author={Fourn , M and Braga, DD and
    Jancar, J and Sabt, M and Schwabe, P and Barthe, G and Fouque, PA and Acar, Y},
    year={2024} }'
  chicago: 'Fourn , M, DD Braga, J Jancar, M Sabt, P Schwabe, G Barthe, PA Fouque,
    and Y Acar. “‘These Results Must Be False’: A Usability Evaluation of Constant-Time
    Analysis Tools,” 2024.'
  ieee: 'M. Fourn  <i>et al.</i>, “‘These results must be false’: A usability evaluation
    of constant-time analysis tools,” 2024.'
  mla: 'Fourn , M., et al. <i>“These Results Must Be False”: A Usability Evaluation
    of Constant-Time Analysis Tools</i>. Usenix Assoc, 2024.'
  short: M. Fourn , D. Braga, J. Jancar, M. Sabt, P. Schwabe, G. Barthe, P. Fouque,
    Y. Acar, (2024).
date_created: 2026-04-30T09:31:29Z
date_updated: 2026-04-30T09:32:34Z
language:
- iso: eng
place: Berkeley
publication_identifier:
  issn:
  - 978-1-939133-44-1
publication_status: published
publisher: Usenix Assoc
quality_controlled: '1'
status: public
title: '"These results must be false": A usability evaluation of constant-time analysis
  tools'
type: journal_article
user_id: '125442'
year: '2024'
...