<i>&quot;Besides not having to deal with the joinery, GCM is sometimes chosen for perf reasons &quot;</i><p>Although going by this,<p><a href="https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;2013&#x2F;10&#x2F;07&#x2F;chacha20.html" rel="nofollow">https:&#x2F;&#x2F;www.imperialviolet.org&#x2F;2013&#x2F;10&#x2F;07&#x2F;chacha20.html</a><p>AES-GCM has performance issue when it comes to software implementations. The reason chrome added ChaCha20+Poly1305 as an option in chrome (when talking to google services).  Now, it basically comes down to hardware support and it&#x27;s not yet near universal in the current install base of mobile devices (all the myriad arm cpus floating around in the world).