What happened to Poly1305AES? Is it obsolete? I've been told that Poly1305AES is a great choice of MAC for constrained (embedded) environments. I'd checked out DJB's writing on it briefly, and have to say that I found its simplicity likeable, performance convincing &amp; security proofs rigorous enough.

But also, libsodium author has told me today that his library won't support this construction.
Because... "it's not used anywhere". I'm baffled by this scarce an explanation.

I'm also confused, since libsodium does support XChaCha20-Poly1305, and AES sure thing — so it has all the primitive pieces; but won't give the combined construction.

Frank Denis also said:


  There is nothing wrong with [poly1305aes], but it's not used anywhere, and it wouldn't have any benefits over existing constructions.


What are those existing constructions? Do I guess correctly, HMAC-SHA2?..

Please shed some light onto the algo; I'm pretty far from advanced cryptography, and this interaction (+ my followup research) only makes me feel "I know that I don't know much".
Poly1305 is a universal hash function. The output of that function cannot be used safely without being encrypted.

In order to encrypt it, any cipher can be used. AES was used as an example in the paper, but the very same paper mentioned:


  Users can switch from Poly1305-AES to Poly1305-AnotherFunction, with an identical security guarantee. All the efforts invested in the non-AES part of Poly1305-AES can be reused; the non-AES part of Poly1305-AES cannot be broken.


In fact, even Bernstein didn’t use this function with AES. The first real-world instantiation of Poly1305 was with Salsa20.

Poly1305 is widely used today, mainly with ChaCha20, a Salsa20 variant.

With AES, it never saw much real-world deployment, and Poly1305-AES has never been part of any standards.

GMAC is very similar to Poly1305, but can benefit from hardware acceleration on many platforms that also provide AES acceleration. This is probably the most commonly used construction today.

On constrained systems, constructions such as AES-CCM are better candidates as the AES core function can be used both for encryption and authentication instead of having to implement two completely different functions.

To recap, Poly1305-AES was just an example. That particular example was not used in practice, as standardized and widely deployed constructions with AES already existed. These were either more compact, or eventually got very efficient due to hardware support.

But Poly1305 is good, especially on hardware that lacks what is required to implement GMAC efficiently (carry less multiplication). So, it is used with ciphers that are also efficient without hardware support, not with AES.