While reading Evaluation of Some Blockcipher Modes of Operation by Rogaway (someone just linked it somewhere), I noticed two claims about CFB that I'm not sure I understand:
Regarding whether CFB mode encryption is parallelizable the paper says (on page 31):
Yes, but awkward. See ISO 10116 for less awkward generalization.
Regarding whether the decryption is parallelizable it says (same page):
Yes, but awkward.
I can't see how this is true at all. To encrypt a block with CFB mode you need the ciphertext of the previous block (or more if $s < n$), so how can you parallelize it?
Parallelizing the decryption algorithm, OTOH, seems very simple, especially when $s = n$ (which I suppose is the "common" case?). I'm unsure what is supposed to be awkward about it, unless it's the fact that with $s < n$ you need to look back more than one $s$-bit block of ciphertext? But since you are still just taking the previous $n$ bits of ciphertext, this seems just like CBC, which wasn't considered awkward.
The ISO 10116 reference might be helpful for showing which awkwardness it avoids, but I don't have access to it.