It's nice to be able to simulate your constant-time code and prove to yourself that you got it right.
Pictured is a simulation of AES chaffing, where fake and real data are computed in a random order. The timing of fake->real and real->fake has to be identical in order to mask power side channels.
26 days ago