Using the ChaCha8Poly1305, I get reasonable performance for authenticated encryption/decryption at 64MHz:

len:   8 encr:  76uS decr:  83uS
len:  32 encr:  81uS decr:  90uS
len:  64 encr: 107uS decr: 116uS
len: 128 encr: 163uS decr: 172uS
len: 236 encr: 259uS decr: 266uS