I want to create a bit-by-bit backup of my DVD and a Blu-ray disc without removing its encryption. Is dd be the best method, and if so, what flags or settings should I use? Also, is comparing the SHA-256 hash of the generated ISO file with the hash of the original disc’s raw data (read from /dev/sr0) the best method for verifying the backup’s integrity?


There’s no such thing as a bit-for-bit copy of anything, you are always deciding what to copy and what not to copy. When you copy a file you might or might not copy the last modified time.
Optical disks use error-checking codes. You usually don’t want to copy those. Even on a non-encrypted disk you don’t want to copy a scratch on your disk onto a new disk with a scratch, you want to decode it and then encode it again to one with the scratch patched over. And it would make your file bigger for no reason when copying to a medium that can’t scratch.
ISO format is designed for computer disks. It doesn’t work for audio disks or other types of things you can put on a CD. ISO has the bitstream as a computer reads the filesystem, which is already after several layers of decoding. Audio CDs don’t use that decoding so they can fit more data, so they just can’t fit in an ISO file.
Encryption is like this too. If you could just copy an encrypted disk as an ISO and it would still work, that’d be shitty encryption so they wouldn’t bother with it. They use tricks to put data outside of the normal copied areas. A really old form of copy protection was to mess up the lower layers - write a sector that would look so scratched it was unreadable, and if you can read it, it must be a copied disk. Or write the same sector several times, so the drive will find a different version of it depending on where it started from. The PS1 wrote the track a bit wobbly, like the CD writer was drunk, but not so wobbly the PS1 couldn’t read it, then used the shape of the wobble to encode a signature that said it was a genuine disk. Don’t ask me how Bluray DRM works, I don’t know it, but it must be using similar kinds of tricks. Storing data in the disk’s barcode was another trick some consoles did.
Thanks for the heads-up, I didn’t know it wasn’t possible