"It's complicated". CBC does not provide authentication, thus it does not protect your encrypted content from manipulation (which can enable all kinds of follo

"It's complicated". CBC does not provide authentication, thus it does not protect your encrypted content from manipulation (which can enable all kinds of followup attacks). Generally you should avoid using unauthenticated ciphers almost always and use an AEAD. SSH uses CBC in combination with a MAC, so it has authentication, but it combines them in an insecure way. It turns out it's practically impossible to avoid these attacks (there had been countermeasures, but it's been shown that they can be circumvented). The attacks only let an attacker decrypt a single byte in certain situations, so the practical impact is limited. Here's the original attack: https://www.isg.rhul.ac.uk/~kp/SandPfinal.pdf https://www.isg.rhul.ac.uk/~kp/SandPfinal.pdf Here's an updated paper that shows that the countermeasures against the original attack don't work. https://www.isg.rhul.ac.uk/~kp/surfeit.pdf https://www.isg.rhul.ac.uk/~kp/surfeit.pdf