Thanks, that was quite helpful. I would say that "compress, then encrypt is bad" is the wrong message to take away from this type of vulnerability. In the case

Thanks, that was quite helpful. I would say that "compress, then encrypt is bad" is the wrong message to take away from this type of vulnerability. In the case of CRIME in particular, the issue was that: 1. The attacker provided part of the message. 2. The rest of the message contained a secret. 3. The entire message (attacker-provided-part and secret) were compressed together. We can stop there; the length of the compressed data now contains information about the similarity between the attacker-provided content and the secret. The correct lesson to take away from this is "do not compress a combination of attacker-provided content and secrets". Compressing before encrypting is perfectly sensible. (And, by the way, compressing after encrypting isn't better, it is useless since your encrypted content ought to be incompressible.)