The web pages of BearSSL have the following performance numbers:
- Poly1305 1730.92 MB/s, amd64, ctmulq
- AES-128 CTR 92.38 MB/s, amd64, ct64
It seems that constant-time Poly1305 is over an order of magnitude faster than AES-128 in the counter mode, without any special CPU instruction support in either.
My understanding is that Poly1305, however, is based on AES (source). Why can something based on AES be faster than AES by a so wide margin?