Small message sizes don't seem to slow it down much according to DJB's paper[0]. It doesn't use large s-boxes or a lot of other internal state, unlike AES does.

Small message sizes don't seem to slow it down much according to DJB's paper[0]. It doesn't use large s-boxes or a lot of other internal state, unlike AES does. Its cache footprint is fairly small. [0] https://cr.yp.to/snuffle/salsafamily-20071225.pdf#2 https://cr.yp.to/snuffle/salsafamily-20071225.pdf#2 (page 2)