I laughed when I read that GCM is hard for library authors. I remember trying to implement GCM but failing, so I decided to transcribe a "simple implementation" but failed at that also.
Then I decided to try OCB mode and it worked on the first try.
I think it would have been far more popular if Rogaway hadn't kept it patented well beyond the point where it was clear patented crypto had no future. It's a pretty neat solution to the problem and the continued insistence on restricting its usage with a patent is one of the more baffling things I've seen in the crypto world.
I have no mathematical background at all (I am an orchestra musician), and I did get it to mostly work. It was just that it didn't work for some inputs, and I could never figure out why despite having access to a proper debugger and a good repl (in scheme).
OCB was a breeze in comparison.
Caveat: I never understood the birthday attack from Ferguson on OCB and why it doesn't work on GCM, so I am really not the right person to make any recommendations
Then I decided to try OCB mode and it worked on the first try.
By the way, isn't OCB unpatented as of recently?