> I’m looking at it from the user of crypto perspective. The user wants something that works reliably. If it's hard to implement, confidence decreases. You ca

> I’m looking at it from the user of crypto perspective. The user wants something that works reliably. If it's hard to implement, confidence decreases. You can compensate with external audits, but those are expensive. > If you don’t care about a built in MAC, would you recommend CTR? OCB? You almost always care about built in MAC. If you don't authenticate your data, you will most likely run into trouble. And if you really don't care, I'd rather sidestep the CTR vs OCB vs WTF entirely by using Chacha20 (fast without dedicated hardware, naturally immune to timing attacks, dead simple to implement). (In the general case, I'd recommend Chacha20 + Poly1305 constructions.)