The goal of the thesis is to design and implement process and supporting tool(s) for automatic performance profiling of code running on a JavaCard platform inside cryptographic smartcards. As the measurement cannot be performed directly on the card due to lack of an on-card clock, host-side measurement techniques have to be used, combined with source code modifications allowing for finer-grade measurements. The use of performance measurements is two-fold 1) help to detect inefficient code and 2) detect timing leakages in cryptographic implementations.
The theoretical part of the thesis will survey available approaches and existing tools for performance analysis and detection of non-constant time behavior and assess their applicability to smaller embedded devices and smartcards. In the practical part, a tool for automatic insertions of helper code into the source code of an inspected applet will be created, based on suitable Java parser (e.g., Spoon). Transformed source code will be then uploaded and executed on a real card with partial measurements (utilizing inserted helper snippets) to provide detailed performance measurement of applet's code.
The tool will be then used as part of the setup for verification of constant-time execution for cryptographic code processing sensitive values which might otherwise leak sensitive data to an attack via timing side-channel. The practical demonstration will be performed on JCMathLib library and one other open-source project, followed by improvement of its resiliency against side-channel attacks. The tool will be also used to perform system-wide survey of properties of open-source JavaCard applets and provide insight into JavaCard open-source ecosystem (required memory allocations, used imports and constants, performance...)

The collected performance metadata will be presented in suitable form, e.g., via static html page (similarly to gcov) with links to measured data-to-time dependency graphs.
Literature:
Pawlak et. al.: Spoon - Source Code Analysis and Transformation for Java, http://spoon.gforge.inria.fr/
Jancar, J.: The state of tooling for verifying constant-timeness of cryptographic implementations https://neuromancer.sk/article/26
Svenda et. al.: JavaCard Algorithm Test, http://jcalgtest.org/
JCMathLib, https://github.com/OpenCryptoProject/JCMathLib
gcov - coverage testing tool, https://www.man7.org/linux/man-pages/man1/gcov.1.html
Curated list of JavaCard applications, https://github.com/EnigmaBridge/javacard-curated-list