Is this vulnerable to a timing attack?