Hardware instructions for AES and GHASH make AES-GCM faster than ChaCha20-Poly1305. Apparently the most popular cipher mode used in TLS is AES-GCM and has seen

Hardware instructions for AES and GHASH make AES-GCM faster than ChaCha20-Poly1305. Apparently the most popular cipher mode used in TLS is AES-GCM and has seen a lot of attention, including its inclusion in the linux kernel[1]. OTOH, ChaCha20-Poly1305 is used for mobile, for example by Google[2]. [1]: https://lwn.net/Articles/666509/ https://lwn.net/Articles/666509/ [2]: https://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html https://security.googleblog.com/2014/04/speeding-up-and-stre...