We need a drop-in replacement for AES, and Gimli doesn't have a 128-bit block size.