4 ms·

GCM is terrible, but it's not patent-encumbered, unlike OCB mode (which is otherwise superior IMHO).

• tptacek 11y ago
  OCB breaks down if nonces repeat, too (though not quite as badly). But Salsa/Poly is strictly superior to GCM.