Nate Lawson has a good explanation of timing attacks (against my own code): http://rdist.root.org/2009/05/28/timing-attack-in-google-key...

Response timing can be indicative of the key, especially if you have the crypto algorithm's code (source/IR/machine code).