Both, unless I don't understand the distinction you're trying to make. The problem is that the law of large numbers is on the attacker's side. If the attacker

Both, unless I don't understand the distinction you're trying to make. The problem is that the law of large numbers is on the attacker's side. If the attacker gets N tries his statistical power goes as sqrt(N), which means that to stay safe the variance in your random delay has to be large enough to cover that. That is, if d is the timing difference between the slow path and the fast path and the attacker gets N tries, the variance in your random delay has to be on the order of d sqrt(N). This is huge even for modest values of N.