All AES candidates due to specification were Pseudo-Random Permutation (PRP), however, today we don't need a PRP. We can live with a Pseudo-Random Function (PRF) since the CTR mode is designed for PRFs. CTR modes don't need the reverse operation as CBC. This can reduce the area/time cost of implementations.
As an example; the ChaCha is a PRF and turned into a cipher with the CTR mode. It is based on add-rotate-XOR (ARX) operations - 32-bit addition, bitwise addition (XOR), and rotation operations.
All of the cipher suites in the TLS 1.3 (AES-GCM, AES-CCM, and ChaCha20) use CTR mode. The bonus; no padding oracles.
Using AES (PRP) in GCM and CTR has a long message distinguisher and therefore we need to restrict the number of encryption blocks due to the PRP-PRF switching lemma.
So I can say, a PRF with 256/512-bits block size and 128/256/512 key and 128/256 IV sizes. With this, we can live without IV collisions and long message problems. Plus, 32/64 bit CPU friendly design.
- No padding oracles
- There is no need for a key schedule as in ChaCha
- No need for a separate decryption circuit.
- CPU friendly.
- Possibly an ARX - fast, cheap, and easy constant-time implementation on SW/HW.