I read that AES/GCM is a good choice for authenticated encryption because:
- AES has very strong heuristic security
- Encrypt-then-MAC leaks no information about the plaintext
- The CW-MAC in GCM can be hardware accelerated using the PCLMULQDQ instruction
- AES can be hardware accelerated
I also read that Salsa20 and Sosemanuk are 5-6 times faster than AES.
This leads me to ask why the eStream ciphers like Salsa20 and Sosemanuk are not deployed with the IV-CTR-mode in Encrypt-then-MAC configuration for Authenticated Encryption?
I am definitely a beginner, so I hope you'll excuse me if the question is naive.