The issue is that for most authenticated modes, you have to run the block cipher twice in some manner, once to encrypt and once to authenticate. OCB is an exce

The issue is that for most authenticated modes, you have to run the block cipher twice in some manner, once to encrypt and once to authenticate. OCB is an exception but I don't know what its status is these days; and, iirc, it still has to do some finite field arithmetic which can be slow in software.