Carter-Wegman MAC variants (VMAC, UMAC etc) are known to be very fast and efficient when compared to MAC algorithms that are based on block ciphers and compression functions (like HMAC, CMAC etc).
However, Carter-Wegman MAC variants are not very popular on the internet like HMAC. Why is this so? Do Carter-Wegman MAC variants have some disadvantage that prevents them from being widespread?
A lot has changed recently in this area. Now the only ciphersuites Chrome considers non-obsolete (those that use AES-GCM or ChaCha+Poly1305), do use Carter-Wegman MACs.
So, I would say that there is no disadvantage and that any low popularity has been just an artifact of historical decisions in standardization. Secure hashes were the first to be openly standardized and exportable, so they were used for MACs as well.
