Poly1305-AES vs AES-GCM What are the advantages of  Poly1305-AES  over AES-GCM? Please note I am not talking about chacha20-Poly1305 that has been widely adopted, including by Google. But I would like to know pros and cons of Poly1305-AES vs  AES-GCM
Poly1305-AES is a message authentication code.  AES-GCM is an authenticated cipher.  So it isn't a meaningful comparison.

But we could compare Poly1305-AES with AES-GMAC, which is a message authentication code.  They're both Carter–Wegman–Shoup MACs built out of the block cipher AES and a universal hash family based on polynomial evaluation with differential probability bounded well below $2^{-100}$.

One essentially inconsequential difference is that Poly1305-AES uses part of its key directly for its universal hash while AES-GMAC passes its key through AES to derive a universal hash key.

The main difference between Poly1305-AES and AES-GMAC is the type of arithmetic used by the underlying universal hash family, Poly1305 or GHASH, respectively:


Poly1305 uses arithmetic in the prime field $\mathbb Z/(2^{130} - 5)\mathbb Z$ which is easy to implement fast in software without timing side channels.
GHASH uses arithmetic in the binary field $\operatorname{GF}(2^{128})$ which is hard to implement fast in software without timing side channels: if you don't have hardware support—or if a bug somewhere deep inside your leaning tower of software in a modern software stack has caused it to fail to take advantage of hardware support—then either your software will be slow, or your software will leak secrets through timing side channels.


Poly1305 is optimized for fast safe software implementations, whereas GHASH is a security risk unless you can guarantee you're using hardware support.  Optimized implementations with hardware support are comparably fast, running at about 1 cpb.

Of course, the same criticism of GHASH applies to AES itself, which is why you should really use ChaCha20-Poly1305 instead of AES-GCM or anything built out of Poly1305-AES.