Why do the messages in IND-CPA have to be of same length I understand the general idea of IND-CPA, however I fail to understand why the messages the adversary chooses have to be of same length. I guess that with variable length messages there would always exist a successful attack and therefore CPA security would not exist. Can anyone guide me into a direction on how such an attack would look like?
Here is an outline of such a distinguisher would work; if you submit a one byte plaintext, then the resulting ciphertext length will follow some probability distribution (with many ciphers, it will be one fixed length; we'll consider the more general case where it is probabilistic); for this probability distribution, we'll have some $N$ where the probability of the length being less than $N$ is $\ge 0.75$.

So, we submit two plaintexts; one consisting of 1 byte, and the other consisting of $N+1$ random bytes.  If the ciphertext corresponds to the short plaintext, the ciphertext will be of length $&lt; N$ with probability $&gt; 0.75$; if the ciphertext consists to the long plaintext, the ciphertext will be of length $&lt; N$ with probability at most $\frac{1}{256}$ (can be shown by the pigeon-hole principle); hence just looking at the length of the ciphertext can serve as the distinguisher.

Obviously, one way to get around this approach would be to pad out all encrypted messages to a fixed length (and have an arbitrary length bound on plaintexts).  However, this sort of thing is expensive in practice; the leaking of the plaintext length is generally considered acceptable.