For benchmarking ChaCha8, I ran: go test -bench=Block internal/chacha8rand For benchmarking AES-GCM, I edited src/crypto/cipher/benchmark_test.go:51 to ad

For benchmarking ChaCha8, I ran: go test -bench=Block internal/chacha8rand For benchmarking AES-GCM, I edited src/crypto/cipher/benchmark_test.go:51 to add 256 to the length list, and then I ran: go test -bench=GCM/-128-256 crypto/cipher GODEBUG=cpu.aes=off go test -bench=GCM/-128-256 crypto/cipher You're right that we could use AES where available in the places where reproducibility doesn't matter, although that's a second implementation to debug and maintain. ChaCha8 seems fine.