What makes an algorithm "fast in software" vs. "fast in hardware"? When reading about different algorithms, I often encounter claims that various algorithms are "fast in software" (e.g. Salsa20) or "fast in hardware" (e.g. DES). What properties make a cipher relatively faster in hardware or faster in software? Why would something be fast to implement in hardware but much slower in a software implementation?
"In software" means programming the cipher on a multifunctional processor or smart chip. The normal instruction set is used to build the algorithm, and not available operations have to be emulated.
"In hardware" means building the cipher in real hardware, like on a Field-programmable gate array (FPGA) or Application-specific integrated circuit (ASIC).
(Nearly?) all ciphers are faster in hardware than in software, but we say "fast in software" if an algorithm is not much slower in software than in hardware.

Some operations can be done fast in software, some other are hard to emulate for the typical x86 (or x86-64) processor. A few examples:


Bit shifting (with a constant length) is one of the fastest things in hardware. You can just connect the outputs with the appropiate inputs on the silicon, no transistors needed. Only the speed of the input / output and the current limits this kind of operation, while in software you have to "waste" an entire CPU cycle.
Additions are pretty fast in software, because that's what processors are made for. Higher integer performance was the main goal of CPU optimizations in the past and is even now of high priority. Additionally it's pretty costly to implement big bit size adder because of the carry over. All this makes addition preferable for software implementation.
Permutations are slow in software, but very fast in hardware. It's the same like bit shifting in hardware, but slow in software because there's no specialized operation for permutations. It has to be emulated, and that's pretty costly. Here's a document about fast software permutation instructions. With this a CPU could be much faster at this task.


Other important factors are as example Pipelining. This can enhance the performance on hardware (and limited in software) and reduce the needed area of the chip. All this factors lead to the fact that some ciphers are "faster in hardware" than "in software" or the other way round.