The priority order here is chosen based on what crypto algorithms Zig has available in the standard library as well as what is faster. Following are a few data points on the relative performance of these algorithms.
Measurement taken with 0.11.0-dev.810+c2f5848fe on x86_64-linux Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz: zig run .lib/std/crypto/benchmark.zig -OReleaseFast aegis-128l: 15382 MiB/s aegis-256: 9553 MiB/s aes128-gcm: 3721 MiB/s aes256-gcm: 3010 MiB/s chacha20Poly1305: 597 MiB/s
Measurement taken with 0.11.0-dev.810+c2f5848fe on x86_64-linux Intel(R) Core(TM) i9-9980HK CPU @ 2.40GHz: zig run .lib/std/crypto/benchmark.zig -OReleaseFast -mcpu=baseline aegis-128l: 629 MiB/s chacha20Poly1305: 529 MiB/s aegis-256: 461 MiB/s aes128-gcm: 138 MiB/s aes256-gcm: 120 MiB/s
const cipher_suites = if (crypto.core.aes.has_hardware_support)
array(u16, tls.CipherSuite, .
const cipher_suites = if (crypto.core.aes.has_hardware_support)
array(u16, tls.CipherSuite, .{
.AEGIS_128L_SHA256,
.AEGIS_256_SHA512,
.AES_128_GCM_SHA256,
.ECDHE_RSA_WITH_AES_128_GCM_SHA256,
.AES_256_GCM_SHA384,
.ECDHE_RSA_WITH_AES_256_GCM_SHA384,
.CHACHA20_POLY1305_SHA256,
.ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
})
else
array(u16, tls.CipherSuite, .{
.CHACHA20_POLY1305_SHA256,
.ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,
.AEGIS_128L_SHA256,
.AEGIS_256_SHA512,
.AES_128_GCM_SHA256,
.ECDHE_RSA_WITH_AES_128_GCM_SHA256,
.AES_256_GCM_SHA384,
.ECDHE_RSA_WITH_AES_256_GCM_SHA384,
})