Can compression + encryption sometimes be beneficial? I hope this question hasn't been asked before: I searched and couldn't directly find it.  It is known that in specific applications, compression followed by encryption leaks information of the length of the compressed message, which, combined with the possibility to inject known plain text in the message, can leak sufficient information as to break the encryption entirely.  There are real-world examples where such plain text injection is a possibility, and there, compression+encryption is a bad idea.  There are other applications, like VoIP, where data packets have comparable length before compression, but compression will change these lengths in ways that betray sufficient aspects of the data to allow, again, for a leakage of plain text information.

In all these cases, the vector is the variable length of the compressed plain text that is leaked.

This counter-intuitive result is opposite to the old cryptographic idea that "pre-whitening" which is also an effect of compression, is beneficial.

So, my question is: are there cryptographic applications where compression + encryption is beneficial over simply encryption (as old wisdom would have had it), or is compression in several cases dangerous, and at best, sometimes harmless, but never beneficial to encryption ?  In other words, is "pre-whitening" still sometimes an advantage, or not ?  I'm not talking about the gain in room or bandwidth.  I'm talking on the cryptographic side only.
Regarding your comment about the CRIME attack, I think I can write an answer:

TLS is one of the common ways for encrypted communication, which gave the CRIME attack a lot of attention. However, I think you drew the wrong conclusions there:


First and foremost, not the encryption scheme was broken. The attack broke the protocol. That is a massive difference.
It only affected those TLS versions, which used a different algorithm: DEFLATE. And the attack works only with that, not a general compression algorithm.


And now I have to say, that your conclusion is probably going into the wrong direction. It is the wrong conclusion to say that coupling compression and encryption is bad in general.   Here are some conclusions I would draw from this:


It's very important to design protocols properly. Someone will find the most unlikely weakness.
Think of all possibilities - especially when it comes to user input and third-party libraries and programs. When it comes to security, better expect the worst than missing something crucial.
The functionality of DEFLATE is quite horrible when you have to consider that linking backwards with short tokens is actually bad. We can only speculate, that it might have been an oversight when it was permitted as compression algorithm.




Regarding the VoIP weakness: Again, that has nothing to do with the security of the encryption schemes itself. It does not break the encryption, but the conidentiality of the communication.

And the reason for that is the combination of timing, the length and number of each individual message etc. All those criteria are not hidden by encrypting the individual messages, and the error here is from the designers, who might not have considered that it's a bad idea if the flow of the messages (length and density of messages over time) actually reflects the content of the messages.

However, that's a sidechannel in this specific scenario. It is not a weakness in general for compression algorithms, but a very specific situation and the information used is actually outside the scope of the encryption (the meta-data).


  I considered this known problems... I didn't know there was anything controversial about it.


The examples are not controversial - but the generalization of them is IMO unreasonable. Also, those incidents actually are not an ideal fit for this site but security-SE would be much more fitting.