Adam Langley thinks that NIST continually pick algorithms that aren't suited to software implementations. https://www.imperialviolet.org/2012/10/21/nist.html ht

Adam Langley thinks that NIST continually pick algorithms that aren't suited to software implementations. https://www.imperialviolet.org/2012/10/21/nist.html https://www.imperialviolet.org/2012/10/21/nist.html (In a NIST paper about the selection of AES they state: “table lookup: not vulnerable to timing attacks.” Oops. If you're building your own hardware, maybe.)