Is AES_128_CCM_8 still the lowest common denominator?
RFC7925 says this. The replacement (“RFC7925bis”, aka draft-ietf-uta-tls13-iot-profile) says the same, plus TLS_CHACHA20_POLY1305_SHA256 as the fallback. The assumption is that CHACHA20 in software will better than AES+GCM in software.
But, maybe hardware evolves to support more things?
I know that our PSA code is not complete yet, but maybe there is some information.