why not AES256 with CTR ?

[jcmartins]

Advantages of CTR are: easier to decrypt from a certain offset within the ciphertext no randomness requirements for the nonce nonce can be calculated, e.g. be a simple counter nonce can be a message identifier E=D : encryption is the same as decryption, which means only encryption or decryption required from the block cipher less logic required

no padding overhead or mechanism required key stream can be pre-calculated (latency advantages)

[malnick]

I didn't really have an opinion about the mode. Though CTR has advantages due to less complicated implementation, I've implemented CBC before, and I felt comfortable doing it for this project.

That being said, this project hasn't really been kept maintained, and I have a lot on my wish list. One of those things is a pluggable backend for encryption/decryption. That would include the key provider (KMS, RSA keys, etc) and the underlying cryptography (AES256 with CBC, CTR, or OFB).

Great question, and thanks for checking out the project.