First, start with there are no good constant-time data structures. After reading the HN thread, I wanted to see if the attack was truly viable. Can we recovery a JSESSIONID? My previous efforts attacking Lua took a slightly different tack.
more here......http://www.tedunangst.com/flak/post/timing-attacks-vs-hash-tables
more here......http://www.tedunangst.com/flak/post/timing-attacks-vs-hash-tables