File Encryption using pynacl
Code / protocol comments under the code sections.

def read_file_blocks(file, extra_bytes=0):
    while True:
        data = file.read(BUFFER_SIZE + extra_bytes)


At least specify why the extra bytes are used and document what extra-bytes argument means.

def hmac_file(file, key):


Why would you go over the entire file and then dispose of the read bytes only to perform HMAC? You just processed all the blocks in memory! Why blake2b instead of one of the more common SHA-2 hashes?

#Use 4 bytes less than the nonce size to make room for the block counter


I'll bet that this isn't required; undoubtedly the counter is already included. Maybe you can point to a specific requirement to include a block counter every 4MiB?

hmac_key = nacl.hash.sha256(key + nonce, encoder=nacl.encoding.RawEncoder)


At least use HMAC instead of a hash to derive keys, the is a poor man's KDF.

output['key'] = base64.b64encode(key + nonce)


Sorry, output what? The key?

output['signature'] = hmac_file(encrypted_name, hmac_key)


CryptoBox uses an authenticated cipher. No need at all to HMAC it again.


  Algorithm details:
  Encryption:   Salsa20 stream cipher
  Authentication:   Poly1305 MAC