I've been designing and supporting development of large scale IoT systems the last 15 years. And yes tech progress allows us to afford the use of better algorit

I've been designing and supporting development of large scale IoT systems the last 15 years. And yes tech progress allows us to afford the use of better algorithms. But customers are still counting every um2 chip area, gates/chip and ROM, code mem in bytes in 2024 to minimize per-device implementation cost. Automotive, a lot of consumer products and large scale SCADA systems are example of systems where these types of questions are at least evaluated during requirement development and system exploration, design. And yes, shaving of a few cents due to being able to use a MCU with 8 kByte RAM instead of 16 kByte can save a lot of money. And it is being done. When I look and crypto algorithms (in a wide sense) I see more utility in having a primitive that provides AEAD, or can be reused n different way to do secure hashing (for integrity, kdf, random generation for example) as well as AEAD, than having lightweight block ciphers. Most lightweight block ciphers have small block sizes, short keys and a lot of rounds. Lyckily there are some nice algorithms that we can trust. And AES is very scalable.