Adiantum
A length-preserving encryption mode built on ChaCha and Poly1305, meant for devices without AES hardware.
Adiantum was designed by Paul Crowley and Eric Biggers at Google and began protecting storage on low-end Android phones in 2019. It is a tweakable wide-block mode that combines an NH-based hash, Poly1305 and the ChaCha12 stream cipher. It preserves length: a 4096-byte sector becomes 4096 bytes of ciphertext.
Why ChaCha instead of AES? Without AES instructions, AES in software is slow and leaks timing information, while ChaCha is fast and simple on exactly the processors where the problem arises. It is a reminder that the choice of cipher is often made by the processor rather than by the cryptographer.