On: Practical Cryptography for Developers

[tptacek]

It's not useful, and you shouldn't use it. PGP uses a variant of CFB (and is dunked on regularly for it).

Modern systems all tend to use CTR-derived AEAD modes; if I wasn't doing a sealed AEAD, I'd probably do CTR+HMAC.