I have been seeing code using "AES/EAX/NoPadding" but I'm also aware that padding schemes are supported for AES-EAX. I would like to know if choosing NoPadding as a padding scheme has security implications for EAX mode of operation. Thanks!
The EAX mode of operation is defined for 128 bit block ciphers. It consists of a combination of CTR mode for confidentiality and OMAC for authentication and nonce derivation. CTR mode does not require padding, but OMAC does, since it is based on CBC-MAC, when the length of the plain text is not a multiple of 128 bits.
Hence, such specifications might mean one of two things.
- It means that standard OMAC padding is implied and doesn't have to be specified twice.
- It means that the plain text will always be an integer multiple of 128 bits, meaning that the OMAC padding algorithm would never have to be invoked.
Hence, if the API doesn't require you to explicitly specify the OMAC padding specified in the EAX paper, NoPadding will comply with the security claims in the EAX paper.
That said, in some cases there are additional security requirements for hiding the length of the plain text, by padding each message to a fixed length, but that falls outside of the scope of EAX, as well as most (all) other AEAD modes as well.
Assuming this is in Java, then EAX represents the entire algorithm, including the specific padding that is always performed for OMAC. The internal CTR (counter mode) encryption doesn't need padding. So the entire cipher doesn't need to be specified any padding at all.
As EAX certainly doesn't require padding to be used before the algorithm is applied, the answer is most certainly "no".
Even if it would, the padding mode for symmetric modes of operation (such as CBC) are not required for the mode to be secure. This differs from padding modes such as OAEP, which are required to make RSA secure.
Actually, it's rather the opposite: PKCS#7 compatible padding for CBC (
"/PKCS5Padding" in Java) may introduce vulnerabilities against padding oracle attacks.
Padding for block cipher modes of operation may somewhat alleviate issues with side channel attacks based on the ciphertext length. The length of a ciphertext may leak quite a lot of information about the plaintext that was encrypted. In general you may need additional security measures above standard padding such as implemented for the cipher, if you want to protect against such side channel attacks.