 Käsper and Schwabe described a "Faster and Timing-Attack Resistant AES-GCM" that achieves 10.68 cycles per byte AES-GCM authenticated encryption on 64-bit Intel processors.Dai et al.report 3.5 cycles per byte for the same algorithm when using Intel's AES-NI and PCLMULQDQ instructions.