Thanks for this—I was struggling to figure out how the cache timing attack worked until your comment.