CT-KAT: Beyond Pass/Fail in Constant-Time Screening of PQC Implementations

Constant-time screening of post-quantum cryptographic implementations must simultaneously examine secret-dependent execution structure, binary instructions, and timing. Because tests observe different phenomena, no single result supports assessment. We present CT-KAT, which generates test harnesses from configurations and connects functional validation, structural analysis across builds, instruction scanning, and timing measurements. CT-KAT records measurement validity, input relationships, and manual-review status, withholding a no-issue status when evidence is insufficient. We evaluate 25 target-operation pairs and 206 build combinations from 24 pairs with build artifacts. Structural-review targets increase from 11 under one deployment build to 13 across the full matrix; instruction scanning expands the review set to 22. Three of 28 timing comparisons show repeatable differences, but all change public and secret values together. In KyberSlash, structural tests show no signal while binary evidence identifies secret-related divisions. Thus, evidence must be preserved with its interpretation conditions.