It is faster than AES-256-CTR + HMAC-SHA256, especially on Intel chips with AES and PCLMULQDQ instructions.