the timing attack you're describing is extremely common -- not unique to PGP -- and simple to mitigate. do you have more literature about the attack, or attacks, that you're describing?