https://blog.elcomsoft.com/2021/06/breaking-veracrypt-obtain...
Disk encryption is generally in XTS mode, and not authenticated. That’s not limited to veracrypt.
https://magazine.atavist.com/category/Mastermind/ Recommended reading!
https://en.wikipedia.org/wiki/Comparison_of_disk_encryption_...
> [...] it appears that OpenZFS encryption is far stronger than LUKS or VeraCrypt encryption.
> LUKS and VeraCrypt use the XTS mode of encryption, which is not authenticated, and is vulnerable to some limited recovery of information when an attacker can have access to the encrypted data at different times. On the other hand OpenZFS encryption is authenticated and at the state of the art. Also, you should take care to disable compression when encrypting with OpenZFS.
This is new to me, why?
Random binary data doesn't compress very well, sometimes even negatively.
There have been what’s called “compression oracle” attacks on SSL with compress then encrypt scheme, see CRIME
https://en.m.wikipedia.org/wiki/Oracle_attack
An attacker could inject known plaintext to an unknown source and observe the size of the ciphertext. If the size doesn’t change much, it means the chosen plaintext is correlated with the source. Several variants exist.
Compression is often not recommended in VPNs.
TBH, with whole-disk encryption I would not worry too much about this attack (the threat model is almost always theft where repeated observations of the cryptext after being modified by someone with the key are not practical), but it was core to a lot of vulnerabilities that basically forced TLS-level compression to be almost universally disabled.