Tuning TLS: AES-256 Now Beats ChaCha20 on Every Modern CPU
Ten years ago Cloudflare published the “Do the ChaCha: better mobile performance with cryptography” blog post showing “ChaCha20-Poly1305” edging out “AES-256-GCM” on phones that lacked AES acceleration. Today almost every CPU ships with wide SIMD registers and AES instructions. Apple’s A14 ₂₀₂₀, M1 ₂₀₂₀, and every successor include AES acceleration, and the same is true for most mid-range and flagship Android SoCs. So does that 2015 advice still hold in 2025? I wanted a definitive answer for the ongoing UCall rewrite, so I compared them across different AWS server SKUs with the ring Rust crate, which keeps the benchmarks reproducible while exercising the same kernels shipped in mobile TLS stacks. ...