Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Most block cipher implementations expect users to pad so that the message matches the cipher block size. I understand the purpose of the padding is to make the input match the cipher block size. It also has a the possibly beneficial effect of hiding the actual message length from the observer.
With NaCl secretbox, the documentation is explicit in stating "Note that the length is not hidden.". What exactly does that mean?
It is usually assumed that the length of the message is not secret. Even with padding the approximate length is leaked, and necessarily any encryption reveals a maximum length – or at least information content if compression is used – because the ciphertext cannot in general be shorter than the message.
NaCl's secretbox does not use a block cipher, but a stream cipher – XSalsa20 (pdf) – so it requires no padding and the exact message length is revealed.
If you have a situation where the message length should remain secret, you must ensure that yourself, e.g. by padding the message to a fixed maximum length. Doing that automatically would be wasteful and would limit the message size the algorithm could be used with, which is why it is left for the user.
