Response timing can be indicative of the key, especially if you have the crypto algorithm's code (source/IR/machine code).