It offers very fast encryption and decryption speeds.

It provides both confidentiality and integrity.

It does not require a public key infrastructure.

It allows for non-repudiation, meaning the sender cannot deny having signed the message.