The current accepted answer is out of date and somewhat misleading. Disclaimer: I'm an author on the AEGIS Internet Draft I'm about to talk about.
AEGIS (technically AEGIS-128L and AEGIS-256) has an Internet Draft and TLS cipher suite name. It's in libsodium, the Zig programming language standard library, the Linux kernel, OVH routers, VPN software, and being used in internal deployments. At present, there are known implementations in 7 programming languages. There are also Project Wycheproof test vectors from Google.
Moreover, there are compelling reasons to shift from AES-GCM. AEGIS is the perfect example of that:
- Significantly faster than AES-GCM and AES-OCB with AES-NI. Software implementations are normally faster too. Speed is one of the main reasons AES-GCM is used.
- Easy to implement compared to AES-GCM especially but also AES-OCB. It's merely processing AES blocks, some XORs, and calling the AES round function. Additionally, the Internet Draft has very readable pseudocode and test vectors that can be copied and pasted nicely, unlike some RFCs.
- Better security bounds (e.g. 128-bit security against forgery attacks for a 128-bit tag).
- Went through the CAESAR competition and is still receiving analysis. Other similarly fast algorithms like Rocca-S have received less analysis.
- Context committing in theory (waiting to be proven explicitly as it was never a design goal), which means it commits to the key, nonce, and associated data. AES-GCM, AES-OCB, ChaCha20-Poly1305, and so on are not, enabling vulnerabilities in certain scenarios like the partitioning oracle attack. This is an AEAD design flaw that must be fixed.
- Larger nonces (128 bits for AEGIS-128L and 256 bits for AEGIS-256), meaning they can safely be random.
- Leaking the state doesn't leak the key, which is the case with some other AES-based AEADs.
- Different associated data with the same key/nonce results in a different keystream, which provides some resistance against key reuse in different contexts.
- Suitable as an efficient MAC independent from encryption. Capable of 128- and now 256-bit tags.
Then NIST has decided to standardise Ascon, a CAESAR finalist, for lightweight cryptography applications. The fact it succeeded in two competitions suggests one can be confident it is safe and worth using.
Finally, regarding the slow/lack of response, I would like to draw your attention to this answer to another CAESAR question. This aides the existing answer, which makes a good point about AES-GCM being widely adopted. It always takes a while for new algorithms to be adopted.
