Comparing GCM to CBC+HMAC is not fruitful because they are different in too many aspects. I already stated in the very first message in this thread that HMAC is

Comparing GCM to CBC+HMAC is not fruitful because they are different in too many aspects. I already stated in the very first message in this thread that HMAC is far more robust than GMAC. Compare CTR+HMAC vs CBC+HMAC. What I take issue with is people stating that CBC somehow provides more security than CTR mode under IV reuse. (Ie your statement that it provides defence in depth). That is a statement that doesn’t stand up to scrutiny in any rigorous way. Both fail pretty badly. Learning the XOR of two plaintexts is sometimes worse than learning if they share a common prefix, sometimes not. Put it another way, how would using CBC vs CTR mode in any way impact your response to learning you had a IV reuse bug in production? It wouldn’t in any meaningful way at all - you’d still have to assume that the data was compromised to some degree. Compare that to a real defence in depth like SIV mode, where in most cases (not all) you could assume that no data breach occurred. Thomas Ptacek thinks that I’m being a purist about this stuff. Fair enough. But I think people who believe that CBC provides meaningfully better protection than CTR in the real world are kidding themselves.