"Besides not having to deal with the joinery, GCM is sometimes chosen for perf reasons " Although going by this, https://www.imperialviolet.org/2013/10/07/cha

"Besides not having to deal with the joinery, GCM is sometimes chosen for perf reasons " Although going by this, https://www.imperialviolet.org/2013/10/07/chacha20.html https://www.imperialviolet.org/2013/10/07/chacha20.html AES-GCM has performance issue when it comes to software implementations. The reason chrome added ChaCha20+Poly1305 as an option in chrome (when talking to google services). Now, it basically comes down to hardware support and it's not yet near universal in the current install base of mobile devices (all the myriad arm cpus floating around in the world).