I use LibTomCrypt on some embedded devices. It's a good library and does what I need to do, plus other stuff. I can even configure it easily to not compile the stuff I don't need to use. And on my embedded devices, I have to do that to make things fit. But when testing on a PC, I don't need to configure out anything because I don't have to, so why take the time. And then if my PC code gets grabbed by another application and used where they don't need to optimize anything, and so on, that's where the bloat happens.