GHASH requires carryless multiplication of large numbers, and fast software implementations of that operation involve lookup tables, which leak memory timing.
And large lookup tables create potential performance problems for large numbers of simultaneous connections. Plus there is non-trivial per-key setup time for the GHASH tables, which hurts key agility. Both of these things tend not to be measured well in benchmarks, which makes even "fast" GCM software implementations somewhat slower in practice than might be expected.
Comments
GHASH requires carryless multiplication of large numbers, and fast software implementations of that operation involve lookup tables, which leak memory timing.
And large lookup tables create potential performance problems for large numbers of simultaneous connections. Plus there is non-trivial per-key setup time for the GHASH tables, which hurts key agility. Both of these things tend not to be measured well in benchmarks, which makes even "fast" GCM software implementations somewhat slower in practice than might be expected.