TIMECOP: Quantum Rewinding & Constant-Time Verification

• TIMECOP is a dual-named construct: in quantum information, it implements a heralded qubit rewinding protocol using interferometric superposition, and in cryptographic engineering, it acts as a dynamic analyzer for constant-time policy enforcement.
• The quantum TIMECOP protocol achieves state rewinding by employing a primitive gate that splits the qubit into superposed trajectories, leveraging commutator identities to reverse time evolution with high probability.
• The software TIMECOP tool utilizes Valgrind-driven taint tracking to flag secret-dependent operations, providing rapid feedback on potential timing leaks in cryptographic implementations.

TIMECOP designates two unrelated research constructs in recent literature. In quantum information, it names a universal quantum rewinding protocol that acts on a target qubit and propagates it to the state it had $T$ time units before the experiment started by exploiting path superposition, repeatable uncharacterized operations, and heralded interference (Trillo et al., 2022). In cryptographic engineering, it names a Valgrind-based dynamic analyzer for binary-level constant-time verification, used to detect secret-dependent control flow and memory behavior in compiled implementations, including large-scale evaluation of NIST PQDSS candidates (Adjonyo et al., 4 Sep 2025). The two usages share a name but differ completely in objective, formalism, and application domain.

1. Distinct usages and research domains

The quantum TIMECOP of Trillo et al. is presented as “a universal quantum rewinding protocol with an arbitrarily high probability of success” (Trillo et al., 2022). Its aim is to heraldedly transform

$$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$

for a two-level target system with free Hamiltonian $H_0$, equivalently applying

$R_T = e^{+i\,H_0\,T}.$

The construction assumes $T=s\,\Delta T$ for a fixed time-step $\Delta T$ and integer $s$ (Trillo et al., 2022).

The cryptographic TIMECOP is a dynamic constant-time checker. At its heart, it enforces a classical constant-time policy on a compiled binary by dynamically tracking the flow of secret data through control decisions and memory accesses. In the PQDSS study, it was selected together with Binsec/Rel2 for binary-level verification, while dudect and RTLF were used for statistical analysis of execution time behavior (Adjonyo et al., 4 Sep 2025).

A useful distinction is therefore between quantum TIMECOP, which is an interferometric protocol for universal rewinding, and software TIMECOP, which is a black-box dynamic analyzer for side-channel policy compliance. This suggests that the shared label should be treated as homonymous rather than conceptually connected.

2. Quantum TIMECOP: target system, ancilla, and primitive gate

The quantum protocol operates on a target qubit with system Hilbert space $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$ and a path ancilla $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$ (Trillo et al., 2022). At each use of the primitive gate $Q$, the target is placed into an equal-amplitude superposition of two trajectories, labeled $$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$0 and $$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$1.

Along one arm, the target free-evolves for time $$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$2 under the known unitary

$$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$3

Along each arm, a fixed but unknown device $$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$4 of duration $$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$5 is activated, with action on the internal qubit given by an unknown unitary

$$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$6

or, more generally, some repeatable Kraus-map, although the unitary case is taken for simplicity. The crucial assumption is repeatability: $$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$7 is the same each time the target passes the device (Trillo et al., 2022).

The primitive gate $$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$8 splits $$\lvert\psi(t)\rangle \longmapsto \lvert\psi(t - T)\rangle$$9 into two arms with opposite orderings:

• arm 1: $H_0$0 then $H_0$1,
• arm 2: $H_0$2 then $H_0$3.

After traversal, the joint state is

$H_0$4

The paths are then recombined with a balanced beam-splitter implementing

$H_0$5

This yields, up to normalization,

$H_0$6

with commutator and anticommutator

$H_0$7

A measurement of the path ancilla in $H_0$8 collapses the target to either $H_0$9 with $R_T = e^{+i\,H_0\,T}.$0 at the vertical port, or $R_T = e^{+i\,H_0\,T}.$1 with $R_T = e^{+i\,H_0\,T}.$2 at the horizontal port (Trillo et al., 2022).

3. Quantum TIMECOP: rewinding mechanism, algebraic structure, and convergence

The rewinding effect is based on three identities stated as Proposition 1 for all $R_T = e^{+i\,H_0\,T}.$3 $R_T = e^{+i\,H_0\,T}.$4: $R_T = e^{+i\,H_0\,T}.$5

$R_T = e^{+i\,H_0\,T}.$6

$R_T = e^{+i\,H_0\,T}.$7

These relations underpin both the simplest non-adaptive protocol and the fully adaptive construction (Trillo et al., 2022).

In the simplest protocol, one applies $R_T = e^{+i\,H_0\,T}.$8 once and conditions on the vertical output, then waits for time $R_T = e^{+i\,H_0\,T}.$9, then applies $T=s\,\Delta T$0 again and post-selects the vertical output once more. If both vertical clicks occur, the induced map is

$T=s\,\Delta T$1

so the target is rewound by $T=s\,\Delta T$2 (Trillo et al., 2022).

If the first application of $T=s\,\Delta T$3 yields the horizontal port, the protocol can still be repaired through the relation

$T=s\,\Delta T$4

and, more generally, through $T=s\,\Delta T$5. Additional pairs of $T=s\,\Delta T$6 gates purify the branch structure until an effective $T=s\,\Delta T$7 is obtained, which is the basis of the adaptive interferometric network shown in Fig. 1(c) of the paper (Trillo et al., 2022).

For unitary $T=s\,\Delta T$8, the probability $T=s\,\Delta T$9 of obtaining the vertical port on each use of $\Delta T$0 is

$\Delta T$1

and this probability is independent of the input $\Delta T$2 (Trillo et al., 2022). The adaptive correction pattern is described as a classical random walk on the integer line with absorbing condition when two vertical clicks bracketing the wait have occurred. By generating-function and martingale techniques, whenever $\Delta T$3 the probability of eventually hitting the required two-click pattern is exactly $\Delta T$4. Equivalently, an un-trimmed infinite run succeeds almost surely (Trillo et al., 2022).

For a truncated protocol with at most $\Delta T$5 uses of $\Delta T$6, the success-by-$\Delta T$7 probability has a closed form. Writing $\Delta T$8 for the even number of steps required to see vertical $\Delta T$9 wait $s$0 vertical,

$s$1

The generating function

$s$2

satisfies

$s$3

and numerical checks reported in Fig. 3 show that as $s$4, the truncated success probability approaches $s$5 exponentially fast whenever $s$6 (Trillo et al., 2022).

The protocol is generic only when $s$7. If $s$8, the commutator branch never appears and the success probability is zero. Conversely, any nonzero commutator, even arbitrarily small, yields $s$9 and hence eventual success probability $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$0. No knowledge of $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$1 or $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$2 is required; only path splitting, path recombination, and post-selection on the ancilla output port are required (Trillo et al., 2022).

4. Software TIMECOP: formal leakage model and execution policy

The cryptographic TIMECOP enforces a classical constant-time policy on a compiled binary by dynamically tracking the flow of secret data through control decisions and memory accesses (Adjonyo et al., 4 Sep 2025). The policy is stated informally as follows:

For any two executions of the program on the same public inputs but different secret inputs, the sequence of control-flow decisions and memory-access addresses must coincide, and the overall execution cost must be identical.

Using $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$3 for public inputs and $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$4 for secret inputs, with $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$5 denoting the execution trace and $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$6 denoting a cost metric such as cycle count or Valgrind’s internal step counter, the property is formalized as

$\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$7

In practice, two explicit weakenings are noted. First, the method is trace-sensitive and has no soundness, because it observes only one concrete trace per invocation; a violation is reported only if the secret-dependent branch or memory access is actually reached. Second, it uses taint-overapproximation and has no completeness, because entire memory blocks are marked tainted when the secret buffer is poisoned, so expressions that cannot vary in practice may still be flagged (Adjonyo et al., 4 Sep 2025).

Under the hood, TIMECOP relies on Valgrind to treat secret-annotated memory as uninitialized, i.e. tainted. Every time an instruction—load, store, or conditional jump—uses tainted data, TIMECOP emits a warning. The associated leakage model is therefore:

An event $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$8 leaks if $\mathcal{H}_{\rm sys}\simeq\mathbb{C}^{2}$9 reads a value $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$0 that was derived (transitively) from the secret memory region. A program satisfies the (dynamic) constant-time policy if no such events occur on any observed trace. (Adjonyo et al., 4 Sep 2025)

This operational model is narrower than a full microarchitectural side-channel semantics. The study explicitly notes that TIMECOP’s model ignores variable-latency instructions such as integer multiply and divide by default, and recommends complementing it with specialized analysis or extending it to trap these opcodes on architectures where they are secret-dependent (Adjonyo et al., 4 Sep 2025).

5. Software TIMECOP: architecture, harnessing, and invocation

In the PQDSS toolchain, TIMECOP is treated as a black-box dynamic analyzer and is embedded in a three-phase automated workflow (Adjonyo et al., 4 Sep 2025).

The first phase is harness generation. A small C harness is generated that allocates and initializes a public message and a public key, calls crypto_sign_keypair(…) to obtain a secret key, immediately invokes poison(sk, CRYPTO_SECRETKEYBYTES) to taint the entire secret-key buffer, executes crypto_sign(…) exactly once, calls unpoison(sk, …), and exits (Adjonyo et al., 4 Sep 2025).

The second phase is compilation. The harness is compiled together with the candidate library using compiler flags required by TIMECOP, including -g for debug symbols, no optimizations that strip branches, and any Valgrind-specific include paths needed so that poison.h resolves (Adjonyo et al., 4 Sep 2025).

The third phase is Valgrind instrumentation. The resulting binary is invoked as $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$7 No execution timeout is enforced, because the workflow relies on a one-iteration harness. A single Python wrapper script, run_timecop.py, orchestrates harness creation, compilation with scheme-specific compiler flags, and Valgrind invocation (Adjonyo et al., 4 Sep 2025).

The key experimental parameters were:

• --tool=timecop
• --trace-load=yes, --trace-store=yes, --trace-jump=yes
• --error-limit=no
• single-iteration harness with constant TIMECOP_NUMBER_OF_EXECUTION = 1 (Adjonyo et al., 4 Sep 2025)

By default, TIMECOP warns on any tainted-data use in control or memory. No further parameters such as solver back-ends, input depths, or timeouts were needed. The study reports that these defaults trade soundness for full dynamic coverage of the single signing operation, and that performance is dominated by Valgrind’s overhead, typically a few minutes per implementation (Adjonyo et al., 4 Sep 2025).

TIMECOP’s output interleaves Valgrind messages with tool-specific annotations. A typical report is of the form $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$8 or, for control flow, $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$9 In the reported workflow, these lines are scraped and converted into a CSV containing binary offset, source file, line, and instruction type. As a concrete example, the LESS scheme’s rejection sampling produced $Q$0 indicating that permutation[i] = … used a tainted index (Adjonyo et al., 4 Sep 2025).

6. Empirical findings, limitations, and best practices

Applied to all Round 1 and Round 2 NIST PQDSS candidates, TIMECOP ran successfully on 302 library-instance combinations, produced a total of 10,247 binary-level alerts, and mapped these to 191 distinct source-code locations (Adjonyo et al., 4 Sep 2025). It flagged at least one violation in every candidate, often in public parts of data structures, which led to many false positives. It also identified eight cases of legitimate secret-dependent memory in rejection sampling that were later confirmed harmless but noisy (Adjonyo et al., 4 Sep 2025).

On a hand-checked subset of 76 TIMECOP alerts, an estimated 67% were false positives, attributed to over-taints or infeasible branches. In comparison, Binsec/Rel2 flagged only 598 alerts across the same benchmarks, with zero false positives in its selected subset. TIMECOP was significantly faster, approximately $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$1–$$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$2 minutes per binary, and covered entire execution traces, whereas Binsec/Rel2 often timed out or ran out of memory before completion on large-parameter instances, with 30 minute SMT-solver timeouts enforced (Adjonyo et al., 4 Sep 2025).

TIMECOP contributed to the discovery of 26 issues reported to scheme authors. Five were confirmed as genuine, exploitable timing vulnerabilities, including secret-indexed GF(16) lookups in SNOVA, AES S-box indexing in Preon, and FF-table access in Mirath. Many other warnings were either false positives or non-exploitable rejection-sampling behavior (Adjonyo et al., 4 Sep 2025).

The study distills several best practices. It recommends combining tools by using TIMECOP for a fast dynamic sweep and then applying Binsec/Rel2 on hot spots to eliminate false positives. It recommends fine-grained annotation rather than poisoning whole secret-key buffers, explicit unpoison(…) calls at declassification points, recognition that rejection-sampling loops are often non-exploitable, CI integration through Docker or Valgrind-enabled build jobs, documentation of secret boundaries in reference implementations, and hardware-aware supplementation where variable-latency instructions matter (Adjonyo et al., 4 Sep 2025).

The principal limitations are explicit. TIMECOP is single-trace and therefore unsound against unexercised corner cases, and it over-taints and therefore produces false positives. Nevertheless, the study describes its low setup cost, rapid feedback, and direct mapping to source lines as making it a practical first-line defense in cryptographic development workflows (Adjonyo et al., 4 Sep 2025).

7. Comparative significance of the two TIMECOPs

The quantum and cryptographic usages share only a name. The quantum protocol is an interferometric mechanism on a qubit-plus-path system in which coherent superposition of “free-then-device” and “device-then-free” trajectories yields a heralded implementation of the commutator $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$3, and two such commutator events around a waiting interval implement $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$4 (Trillo et al., 2022). The cryptographic tool is a dynamic taint-tracking analysis framework in which secret-annotated memory is treated as tainted and warnings are emitted whenever loads, stores, or conditional jumps depend on that taint (Adjonyo et al., 4 Sep 2025).

Their methodological profiles are correspondingly different. Quantum TIMECOP is built around algebraic identities specific to $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$5 operators, post-selection, and almost-sure success under the genericity condition $$\mathcal{H}_{\rm path}\simeq\mathrm{span}\{\lvert\rightarrow\rangle,\lvert\uparrow\rangle\}$$6 (Trillo et al., 2022). Software TIMECOP is built around a dynamic constant-time policy, Valgrind instrumentation, and a deliberate trade-off between speed and precision arising from trace sensitivity and taint overapproximation (Adjonyo et al., 4 Sep 2025).

A plausible implication is that the shared acronym-like label can obscure substantial disciplinary divergence. In one case, TIMECOP denotes a protocol for universal quantum rewinding; in the other, it denotes tooling for systematic timing leakage analysis. For readers working across quantum information and cryptographic implementation security, the distinction is therefore terminologically important as well as technically fundamental.