It occurs to me that if we do a bitsliced implementation of Serpent in SSE2
(computing 128 blocks in parallel), the rotates and shifts in the linear
transform can be done for free by variable-renaming. So instead of 1728
instructions for 4 blocks, it would take an average of only 31*7.7 + 32*15 +
33*4 = 850 instructions per 4 blocks, or around 4.43 cpb at an IPC of 3.
This doesn't account for loads and stores caused by register spills (which
will require some optimization to minimize), but it seems that Serpent may
finally be able to overtake Rijndael in performance, at least for long
messages in counter mode.

In fact it seems likely that Serpent is now the fastest AES finalist for
this kind of usage, since none of the other 3 can take good advantage of
SSE2 vector instructions.