> Find 10 people who have adopted Poly1305 and ask them what Poly1305 does better than GCM. Two things, one of which cannot be credited to Poly1305 directly.

> Find 10 people who have adopted Poly1305 and ask them what Poly1305 does better than GCM. Two things, one of which cannot be credited to Poly1305 directly. 1. Poly1305 is easier to implement without introducing side-channels (modulo integer multiplication on some CPUs; in which case, I defer to Thomas Pornin on how to avoid them). 2. The Chapoly constructions that use Poly1305 do so in a way that leaking the one-time Poly1305 key doesn't buy you much. (This is the one that cannot be attributed to Poly1305 directly.) Others may have better or different answers. I implemented it in PHP [1], so anyone reading this thread should keep that in mind. :) [1] https://github.com/paragonie/sodium_compat/blob/f3b2d775a50d6f316b311554f4954a1668439551/src/Core/Poly1305/State.php https://github.com/paragonie/sodium_compat/blob/f3b2d775a50d...