In the abstract of the AES-GCM RFC, the following passage is prominently included:
[AES-GCM] can be efficiently implemented in hardware for speeds of 10 gigabits per second and above...
Is the ease/efficiency of hardware implementation a significant consideration in cipher suite or encryption mode? If so, how big a factor is it in the popularity of the system?
More practically, are there examples of common ciphers that present serious challenges in implementation? Or would this immediately discount them?
On the suggestion of the LateralFractal, I looked at the design evaluation criteria for the AES competition. There is a line that references hardware (the criterion is given as "Hardware and software suitability"). That being said, this still doesn't speak to the degree to which this criterion is taken into account.
This paper describing an attack on DFC seems to be a good real-world example. Seeing as this SO's own Thomas Pornin had a role in the cipher's development, I'd be curious hear:
- The severity of this proposed attack in the eyes of the community
- The response from the cipher authors
- Possible ways in which this attack could have been avoided