Among my employer's customers and employees, the people who ask for GCM really want "a TLS algorithm that isn't terrible" - and GCM is more or less the only wid

Among my employer's customers and employees, the people who ask for GCM really want "a TLS algorithm that isn't terrible" - and GCM is more or less the only widely-supported solution. (As you know, OCB's license made it a non-starter, CCM was slower and not Intel-supported, and most other stuff is newer than GCM.) Since people will take their cues from - at best - experts talking about TLS, even an old-fashioned solution like "HMAC plus CBC, but in the correct order" isn't on their radar. It helps that TLS-on-Intel is about the only environment in which GCM isn't too terrible (hardware support fixes side-channel attacks, short-lived connections plus key (re-)negotiation fixes the short counter space, and fortunately nobody has standardized the foot-gun that is short-MAC GCM). Also, GCM does admit very fast pipelined hardware implementations (including AES-NI). SIV, which you suggest downstream, is indeed cool (if you can afford a two-pass algorithm). A colleague suggests that GCM-SIV is likely to lap the CAESAR candidates for inclusion into various standards including TLS, which would be... about half as horrifying, I guess? TL;DR: GCM is bad, but it's TLS which is the worst. ;-)