If a CPU implements AES-NI (or equivalent) machine instructions, then AES128-GCM will be faster, and it's implemented in TLSv1.3. If you value security, then I

If a CPU implements AES-NI (or equivalent) machine instructions, then AES128-GCM will be faster, and it's implemented in TLSv1.3. If you value security, then I'd prefer chcha20-poly1305. If you need speed, then use what your CPU gave you. https://soatok.blog/2020/05/13/why-aes-gcm-sucks/ https://soatok.blog/2020/05/13/why-aes-gcm-sucks/ https://lwn.net/Articles/681616/ https://lwn.net/Articles/681616/ "The GCM slide provides a list of pros and cons to using GCM, none of which seem like a terribly big deal, but misses out the single biggest, indeed killer failure of the whole mode, the fact that if you for some reason fail to increment the counter, you're sending what's effectively plaintext (it's recoverable with a simple XOR). It's an incredibly brittle mode, the equivalent of the historically frighteningly misuse-prone RC4, and one I won't touch with a barge pole because you're one single machine instruction away from a catastrophic failure of the whole cryptosystem, or one single IV reuse away from the same."