Why AES 256 GCM is more preferred by email service providers / banks over the fast and efficient ChaCha20 - Poly1305?

Question

This question is based on my recent observation of preferences of certain email service providers and banks to use AES related symmetric ciphers over the more fast ChaCha20 Poly1305 . For example Google's Gmail browser version uses AES 128 GCM but Google's Search uses ChaCha20 Poly1305 ?

Is AES 128/256 GCM in any way more secure than ChaCha20 Poly1305 ?

Despite the fact that ChaCha20-Poly1305 uses processor friendly instructions for mobile devices, and easy to implement in software, why banks or financial institutions are reluctant to adopt it ?

Is it because of specific AES instructions on processors (as far as servers / PC/ laptops are concerned) or because they are sticking to old convention ?

Answer 1

AES-GCM is standardized by National Institute of Standards and Technology, the institution that drives standards for U.S. Federal agencies.

In some situations (think banking, government, large corporations) FIPS certification is desired and in order to pass FIPS certification you need to use approved algorithms. When you check FIPS 140-2 Annex A, you see that AES-GCM is one of the approved 'security functions'. ChaCha20 Poly1305 is not.

Another reason is that ChaCha20/Poly1305 is a relatively newer design. AFAIK, it has been accepted as an IETF standard in 2015 RFC7539 while AES-GCM is a standard since 2007 (NIST SP800-38D).

Moreover, AES has been around since 2000 and this means there is a lot of IP designs that have dedicated AES accelerators which make AES-GCM very efficient.

When it comes to security, AES is a very solid cipher and I would probably prefer it over Chacha20, but on the other hand GCM mode is very brittle and prone to implementation errors (think IV abuse) and it may be considered less desirable in some implementation-related scenarios.