GCM mode GHASH sensitivity to timing attacks In GCM mode of authenticated encryption, is it a security concern if the GHASH implementation timing can vary?

If the timing varies according to the AAD/ciphertext data, it looks as though that doesn't matter because that data is public anyway. But if the timing varies according to the GHASH key, does that reduce security?
If the timing varies with public information, then it's not a problem.  If the timing varies with secret information like the key in GCM, it is a problem.  (While GCM feeds only AAD and ciphertext to GHASH, other AEAD schemes like GCM-SIV feed the plaintext to GHASH/POLYVAL; timing dependent on any secret information is a problem.)

It's hard to make a fast software implementation of GCM that does not vary with the key, since you're evaluating a polynomial in $\operatorname{GF}(2^{128})$ at the GHASH key.  (t is tempting to make a much faster software implementation that does vary with the key by using variable-time table lookups.)  Worse, each block of the message (AAD or ciphertext) figures into the GHASH formula exactly once, but the key, and its square, and its cube, etc., figures in many times.

And CPU instruction sets and programming languages are historically designed to support integer arithmetic, not Galois field arithmetic, so even on a CPU that does support Galois field arithmetic natively, reliably taking advantage of it requires nontrivial engineering effort.