AES/GCM has obviously proved itself to be better than AES/CBC. Unless the key is re-used with the same initialization vector (see disadvantages of GCM). More information on its advantages against CBC can be found in source 1 and source 2.
So my question is: Why would Signal Protocol use AES/CBC when AES/GCM obviously has better performance?
I just tested (using JMH) AES/CBC vs AES/GCM on a Java implementation and AES/CBC actually beat AES/GCM in performance. I am aware now why Signal Protocol uses AES/CBC but I don't understand how. Signal documentation (section 3.3 after the image) says
"Alice then calculates an "associated data" byte sequence AD that contains identity information for both parties".
And later says Alice sends "An initial ciphertext encrypted with some AEAD encryption scheme 4 using AD as associated data and using an encryption key which is either SK or the output from some cryptographic PRF keyed by SK." Now I downloaded the Signal Protocol source (Java implementation) and did a search they never call updateAAD (a java function to set the additional authenticated data).