.  Two comparisons aren't enough - tens, hundreds, thousands? Probably enough. I'm talking about a Truecrypt volume stored on iCloud or Google Drive - each time you update it, if that traffic is peeped, you can conceivably build a picture of the bit-by-bit differences in the volume itself and thereby compromise it. Am I capable of doing that? No: however, the method is recognized.  In order for an attack like that to remotely work, aside from fact that that attack DOESNT WORK on AES, you would need to know the plaintext of EVERY volume "instance" that you captured. If you did, why on earth would you need the key?  Please dont make statements about "what should work" when you dont understand cryptography.  EDIT:I should note that Truecrypt operates at a block, not bit, level