What's wrong with CBC? I think the bigger problem is the symmetric keys are not using a key derivation function and are therefore not uniformly random: https://github.com/nostr-protocol/nips/issues/72
It’s not tamper proof, ie signed, unlike GCM
> Some modern modes of operation combine confidentiality and authenticity in an efficient way, and are known as authenticated encryption modes
https://en.m.wikipedia.org/wiki/Block_cipher_mode_of_operati...
I’d also add: CBC requires padding and GCM does not. Minor convenience.
And GCM does not ‘add’ a signature per se.
> And GCM does not ‘add’ a signature per se.
Your own comment to which I replied said "It’s not tamper proof, ie signed, unlike GCM". Wouldn't most people consider something "signed" as having a signature?