Aug 15, 2016 · The SSH EP makes CTR mandatory (as our previous blog entry discussed this was intended to bring CC in line with FIPS an DoD UC APL standards) while CBC and GCM are optional. The current draft of NDcPP v1.1 will mandate AES but will allow a choice between CBC, CTR and GCM. Duo is a user-centric access security platform that provides two-factor authentication, endpoint security, remote access solutions and more to protect sensitive data at scale for all users, all devices and all applications.