Comment by lxgr

It's faster on CPUs without dedicated hardware than AES, but that doesn't mean that it's faster than fixed-function AES hardware.