On 32-bit ARM we're seeing AES-GCM as a performance bottleneck. It's possible that ChaCha20/Poly1305 might be an improvement which we could resolve once dynamic ordering is available (Bug 1555404), but we might also have some low-hanging fruit to improve arm32 performance some other way, either by optimizations in the current C implementation, or at compile-time choosing ChaCha over AES if we're on ARM. This meta bug should be the parent for the optimizations we undertake.

Note: as of now, we're discussing our Curve25519 implementation on 32-bit ARM in Bug 1550579.

The newest hardware has AES HW accelerator (WIP is bug 1152625) even if AArch32, but this CPU will support AArch64 mode, so it won't use 32-bit mode binary if Android. Firefox 68+ has AArch64 package for Android.

Bug 1520297 is tracking Intermediate Preloading on Android, which is also an improvement here.