AES256-CBC vs AES256-CTR in SSH I used AES256-CBC to SSH to a remote server. Recently, it stopped working with the following message:

no matching cipher found: client aes256-cbc server  
aes128-ctr,aes256-ctr,arcfour256,arcfour,3des-cbc


When I used AES256-CTR as a cipher to SSH to the server, it worked as expected.

I read this article which outlines the following:


  CBC (Cipher-block chaining)
   Encryption parallelizable: No
   Decryption parallelizable: Yes
  
  CTR (Counter)
   Encryption parallelizable: Yes
   Decryption parallelizable: Yes


Is “Encryption parallelization” necessary in SSH?

Any other advantages of AES256-CTR over AES256-CBC used in SSH except being more robust against padding oracle attacks?
Other advantages of CTR are:


easier to decrypt from a certain offset within the ciphertext
no randomness requirements for the nonce

nonce can be calculated, e.g. be a simple counter
nonce can be a message identifier 

$E = D$: encryption is the same as decryption, which means

only encryption or decryption required from the block cipher
less logic required

no padding overhead or mechanism required
key stream can be pre-calculated (latency advantages)


Draws:


sequential speed the same (about the same number of ciphertext blocks)
cryptographic security (when used properly)


Disadvantages:


nonce reuse is catastrophic, confidentiality is completely lost
leaks somewhat more information about the size of the plaintext
multiple, slightly different schemes with regards to IV creation and the method that the nonce is used
still less common in libraries or known by (starting) developers


Another questionable disadvantage is that CTR has no error propagation, but that should probably be considered an advantage by now; if you want integrity, use an authentication tag (MAC or signature).



You can attack CBC and CTR using different methods, with different consequences. If CBC mode has problems in a certain protocol, then switching to another mode has its advantages of course. See the answer of Thor for good reason to switch to CTR for OpenSSH specifically.

That's probably a better reason to disable CBC than the reasons given above. If you want to know for sure, you should ask the OpenSSH developers though (or the person that disabled CBC-mode, anyway).