For what it's worth, regarding the recommendation in page 14 of the report, there is a portable implementation (well, direct port of the SSSE3 code) of AES-CTR

For what it's worth, regarding the recommendation in page 14 of the report, there is a portable implementation (well, direct port of the SSSE3 code) of AES-CTR in NaCl: https://github.com/jedisct1/libsodium/tree/master/src/libsodium/crypto_stream/aes128ctr/portable https://github.com/jedisct1/libsodium/tree/master/src/libsod.... Don't expect it to be fast or anything, but it exists.