Constant time implementations of crypto algorithms
Any function can be made timing attack resistant, and may be more expensive. I.e. AES can be made safe by using a hardware-simulated constant time circuit for lookups (and maybe more magic).


If you need AES: use hardware with a constant time fallback in software. If you don't need AES then prefer it by hardware, then negotiate to a fast software cipher such as chacha20.


I'm yet to investigate (as I don't use these "standard libraries"). Which libraries are we including in standard? OpenSSL? LibreSSL? BoringSSL? Libsodium?
The AES round function is implemented in hardware. This enables the caller to decide the mode I.e. CTR vs CBC vs GCM etc. Last I checked AESNI included sha1 and sha2, but not any ECDSA nor ECDH nor EdDSA nor RSA. Hardware can implement any of these, however, not all functions have a significant speedup in hardware such that using hardware is preferred.