I've been told that Poly1305AES is a great choice of MAC for constrained (embedded) environments. I'd checked out DJB's writing on it briefly, and have to say that I found its simplicity likeable, performance convincing & security proofs rigorous enough.
But also, libsodium
author has told me today that his library won't support this construction.
Because... "it's not used anywhere". I'm baffled by this scarce an explanation.
I'm also confused, since libsodium does support XChaCha20-Poly1305, and AES sure thing — so it has all the primitive pieces; but won't give the combined construction.
Frank Denis also said:
There is nothing wrong with [poly1305aes], but it's not used anywhere, and it wouldn't have any benefits over existing constructions.
What are those existing constructions? Do I guess correctly, HMAC-SHA2?..
Please shed some light onto the algo; I'm pretty far from advanced cryptography, and this interaction (+ my followup research) only makes me feel "I know that I don't know much".