On a Skylake (i7-6700hq) laptop, on a single core:
$ openssl version
OpenSSL 1.1.1 11 Sep 2018
$ openssl speed -evp aes-128-gcm
$ openssl speed -evp chacha20-poly1305
$ openssl speed -evp aes-128-ccm
The 'numbers' are in 1000s of bytes per second processed.
type 16 bytes 64 bytes 256 bytes 1024 bytes 8192 bytes 16384 bytes
aes-128-gcm 488169.02k 1231926.26k 2414630.74k 3816304.85k 4789598.50k 4845855.68k
chacha20-poly1305 246956.37k 476741.65k 946072.14k 1730753.88k 1871080.29k 1868974.56k
aes-128-ccm 184384.63k 531209.72k 878769.23k 1111729.15k 1197240.25k 1221242.40k
TLS record layer blocks are 16KB, so look at the right most column.
CCM is slower than ChaCha.
That's why reasonable chips won't try to use CCM.
The logic of modern cipher selection is this:
- If you can do AES fast and without side channel problems (e.g. AESNI) and you can do carry-less multiplication fast and without side channel problems (e.g. CLMUL):
- do AES-GCM.
- Else, if you have vector instructions (SSE, AVX, NEON, etc.):
- do ChaCha20-Poly1305.
- Else, if you have AES hardware:
- do AES-CCM.
- Else, if you have no acceleration at all:
- do ChaCha20-Poly1305 slowly.
Servers, laptops and smartphones are in category 1 or 2, so they don't offer CCM.