ideas for tests of security leaks

I discussed how to test for the security of this OTR implementation with a handful of people who know OTR quite well. I came away with these two ideas for tests that should be included:
- check the timing of execution of functions, they should take the same about of time given different input data
- all api functions produce the same outputs given the same inputs
