I need to encrypt some packets on a constrained hardware.
I was enthusiast about the NaCl suit, since Chacha/Salsa20 is a nice and fast symmetric cipher algorithm when no AES-NI instructions is available. But I discovered that poly1305 (the authentication layer) is based on AES!
Why? If I plan to use cryptobox it's because there is no AES; but if AES is available in hardware, may I prefer AES-GCM?
What is the logic behind this? Why poly1305-AES and not poly1305-Salsa20?