Adiantum<sup>1</sup> is a wide-block cipher built out of ChaCha12, NH-Poly1305, and—for only a small part of the computation—AES. Being a wide-block cipher, Adiantum can encrypt, for example, entire 512-byte or 4096-byte disk sectors at a time. For each disk sector, Adiantum calls the AES permutation only once, so even constant-time software AES takes a small fraction of the Adiantum computation time. Adiantum is reasonably fast, many times faster than constant-time software AES-XTS or AES-CBC on many machines, and provides better security; see the paper for performance measurements and security theorem. Android and NetBSD have adopted Adiantum for disk encryption on machines without hardware AES acceleration.<sup>2,3,4</sup> In the NetBSD kernel, AES is computed using constant-time software on machines without hardware AES acceleration.<sup>4,5</sup> <i>Caveat: Adiantum is designed for disk encryption, which reuses the same key over a long period of time for many sectors being rewritten. Unlike the ChaCha or Poly1305 components it uses, Adiantum incurs a high cost to changing keys—not relevant to disk encryption. So it's not very general-purpose. (The same authors proposed HPolyC, at lower throughput but cheaper key agility by using just Poly1305 and not NH.) The disk encryption threat model is also very weak—it is only designed to protect secrets against theft or recycling of your disk, so it does nothing to detect forgery.</i> (Disclosure: I wrote NetBSD's Adiantum and AES code and made the proposal to adopt Adiantum.) --- <sub><sup>1</sup> Paul Crowley and Eric Biggers, Adiantum: length-preserving encryption for entry-level processors. IACR Transactions on Symmetric Cryptology, 2018(4), 39–61. <br/> https://doi.org/10.13154/tosc.v2018.i4.39-61</sub> <sub><sup>2</sup> Paul Crowley and Eric Biggers, Introducing Adiantum: Encryption for the Next Billion Users. Google Security Blog, 2019-02-07. <br/> https://security.googleblog.com/2019/02/introducing-adiantum-encryption-for.html</sub> <sub><sup>3</sup> NetBSD Manual Pages: cgd(4) -- cryptographic disk driver. NetBSD 10.0_BETA, August 16, 2020. <br/> https://man.netbsd.org/NetBSD-10.0-STABLE/cgd.4</sub> <sub><sup>4</sup> Taylor R Campbell, AES leaks, cgd ciphers, and vector units in the kernel. NetBSD tech-kern mailing list, 2020-06-17, message-id ⟨[email protected]⟩. <br/> https://mail-index.netbsd.org/tech-kern/2020/06/18/msg026505.html</sub> <sub><sup>5</sup> Taylor R Campbell, Rework AES in kernel to finally address CVE-2005-1797. NetBSD commit: src/sys, 2020-06-29. <br/> https://mail-index.netbsd.org/source-changes/2020/08/14/msg120525.html</sub>