You should read "Remote Timing Attacks are Practical" (https://crypto.stanford.edu/~dabo/papers/ssl-timing.pdf) published in 2003 by David Brumley and Dan Boneh.