http://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/blog/elliptic-curve-cryptography
However, it is important to note that Curve25519 is a Montgomery curve and therefore these potential timing differences are far less trivial to exploit, as mentioned in the links above. In our mobile and desktop apps, where timing attack resistance is easier to achieve, the X25519 implementation is already constant-time.