The paper is pretty good and does a great job explaining this: Basically, P-state / frequency governor side effects cause "constant-time" implementations of so

The paper is pretty good and does a great job explaining this: Basically, P-state / frequency governor side effects cause "constant-time" implementations of some algorithms like SIKE not to be constant time anymore - because in reality, these implementations were never "constant-time" but rather "constant-cycles" and with clock speed changing, so does the observed wall-clock time. Once this observation is made and the timing oracle understood, it's just a normal remote timing attack - spam the service with constructed data, measure the response time, and eventually your oracle tells you when you got bits right or not.