Taming Timing: Testing Side-Channel Resistance on Java Card Platform

This paper presents a methodology for systematically detecting timing side-channel vulnerabilities in Java Card applets. It combines precise timing measurements, synchronization using power analysis traces, and differential fuzzing to identify inputs that cause data-dependent timing differences, first on a simulator and then on real smart cards. The methodology was evaluated on both controlled examples and real-world Java Card applets, including the Satochip hardware wallet and JCMathLib, where it successfully detected subtle vulnerabilities.