I've run a big number of tests today on a RaspberryPi4 2GB (with official PSU, and checked that no throttling happened; standard RaspiOS).
I used an external USB3 HDD, tested to be able to both read and write from the RPi4 faster than 70 MB/s for sequential 1 GB file, when using a normal (unencrypted)
ext4 partition (just to be sure the disk itself is not the weakest element in the chain).
The following results are to be taken in relative value to compare the FS, not in absolute value.
I tested both:
the RAW write speed on an encrypted partition
dd if=/dev/zero of=/mnt/b/1000mb bs=1M count=1000 iflag=fullblock
(even if constant zero bytes, AES algorithm has to re-encrypt each block, in order for the repetition not be identifiable, see crypto.SE for questions about this, it's common)
the speed of transfer with Samba when sending a 2.3 GB file from a Windows computer to the RPi encrypted partition/container (again I checked that networking, destination computer's disk, etc. were not a bottleneck)
As I want the disk containing encrypted data to be also openable on Windows (let's say my wife needs it), without Linux command-line commands, I tested only exFAT and NTFS.
host ↓ FS inside container → exFAT NTFS
Veracrypt part. dd:41 MB/s samba:!! MB/s dd:28 MB/s samba: 25 MB/s
exFAT part. + Veracrypt container dd:39 MB/s samba:!! MB/s dd:25 MB/s samba: 20 MB/s
NTFS part. + Veracrypt container dd:29 MB/s samba:!! MB/s dd:25 MB/s samba: 15 MB/s
!!: unresponsive Windows Explorer at the beginning of the transfer of 2.3 GB file, for about ~ 30 seconds, and then it begins but quite slow. This seems to be a bug when using
1 GB+ file tranfer from Windows, even without using VeraCrypt. It is even amplified when there is an additional Veracrypt layer.
As a conclusion, the best option if we want the encrypted disk to be readable on Windows too, and to be able to use it via Samba, is to use a Veracrypt partition, containing a NTFS partition.
Note: when not using encryption, using this little "big_writes" trick helps to speed up NTFS writes from 30 MB/s to more than 70 MB/s:
sudo mount /dev/sda4 /mnt/a -o big_writes
But again, after the additional Veracrypt layer, we fall again to ~ 20-30 MB/s.