With symmetric algorithms, e.g. AES, and modes of operation, is there a "best" one? Currently GCM seems to be quite popular. Is there something (an AEAD?) better? Now that the patent of OCB(3?) is expired, is it worth changing?
https://soatok.blog/2020/07/12/comparison-of-symmetric-encry...
EDIT: Actually, the parts about OPAQUE are no longer relevant because they changed the protocol before the RFC was final to not need encryption, but that was just an example of where you'd make this sort of trade-off decision, so the rest of the article is still relevant.
Committing, better performance, random nonces - let's go.
[1] https://datatracker.ietf.org/doc/draft-irtf-cfrg-aegis-aead