Didn't use to be. VIA/centaur was the first to add AES instructions, later picked up by Intel and AMD. Its not free, but not expensive.

A brilliant woman from, where, Slovenia? figured a way to use SSE instructions to encrypt just as fast as the built-in instructions, I think 2 cycles per byte.

I guess DJB's ciphers run much the same way, nowadays.

If you ever track down a citation for that I'd love to know more.

Might be Emilia Kasper, now apparently at Google. Probably it was 2 cycles per bit, not byte.

There are pretty good references starting from https://crypto.stanford.edu/vpaes/ .

https://news.ycombinator.com/item?id=13364762 has interesting discussion.

Bandwidth for signature values in each packet is not. Additionally, as is pointed out down-thread, crypto wasn’t always free either.

Actually the signature was almost free, because it was also the nonce for the header, which was the nonce for the rest of the packet. IIRC.