Zebra policy on side-channels and constant-time

[J08nY]

Hey all,
I was looking for some information about the threat model of Zebra, especially with regards to side-channel attacks, but I did not find anything. Is there some policy? Does Zebra claim resistance to timing attacks (remote/local), cache attacks, etc.?

[conradoplg]

Hi Ján, We don't have an official policy for now. But do note that Zebra does not have a wallet and operates on public data, so the impact of side-channel attacks is very limited. If you have something specific in mind that you want to look into, feel free to ask us to confirm if this is something we might be interested in protecting against. Cheers,

…

On Thu, Feb 5, 2026 at 1:18 PM Ján Jančár ***@***.***> wrote: Hey all, I was looking for some information about the threat model of Zebra, especially with regards to side-channel attacks, but I did not find anything. Is there some policy? Does Zebra claim resistance to timing attacks (remote/local), cache attacks, etc.? — Reply to this email directly, view it on GitHub <#10282>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAIXNQOO3MBNEYH5VJG7HD4KNUONAVCNFSM6AAAAACUDTCMMCVHI2DSMVQWIX3LMV43ERDJONRXK43TNFXW4OZZGQZTGNBWG4> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[J08nY]

Heh, I somehow completely missed this only having done a cursory look at Zebra. Thanks for the info.