Comment by progval

The random times don't have to be uniformly distributed. Though it's enough for attackers to know the distribution to de-noisify it.