[atanasi]

I have heard that AES is very complicated to implement in software, if one intends to avoid side-channel leaks.

[bjoli]

You don't, especially not GCM mode. You use one of the mature tested versions out there.

[bjoli]

To build on this: I was able to implement AES and OCB mode by just reading papers without any code in them. I was, however, not able to implement GCM reliably even by translating a "simple" reference C implementation into scheme. Sure, it worked, but even after 2 rewrites it still did not produce the same output as the simple reference implementation for some edge cases.

All this was done on a just-for-fun basis, but it ended up just making me frustrated so I stopped trying.