> AES is significantly faster in hardware if there is support. this means relying on something that you might not be able to influence: borked HW implementatio

> AES is significantly faster in hardware if there is support. this means relying on something that you might not be able to influence: borked HW implementations. you are essentially saying rolling out to unknown broken devices is fine because the majority of users where HW isn't broken can benefit from better performance. that's a hell of a trolley problem and precisely why OTR switched to ChaCha/Poly. I'm not talking about one being better than the other but implementation matters and those projects (like OTR) where security is the only value proposition, then maybe AES is a risky choice? Sure AES is maybe the victim of it's own success and if chips get ChaCha implementations in HW then we'd also have broken implementations at scale. But that wasn't my point.