Does EAX require padding to be secure? I have been seeing code using "AES/EAX/NoPadding" but I'm also aware that padding schemes are supported for AES-EAX. I would like to know if choosing NoPadding as a padding scheme has security implications for EAX mode of operation. Thanks!
The EAX mode of operation is defined for 128 bit block ciphers. It consists of a combination of CTR mode for confidentiality and OMAC for authentication and nonce derivation. CTR mode does not require padding, but OMAC does, since it is based on CBC-MAC, when the length of the plain text is not a multiple of 128 bits.

Hence, such specifications might mean one of two things.


It means that standard OMAC padding is implied and doesn't have to be specified twice.
It means that the plain text will always be an integer multiple of 128 bits, meaning that the OMAC padding algorithm would never have to be invoked.


Hence, if the API doesn't require you to explicitly specify the OMAC padding specified in the EAX paper, NoPadding will comply with the security claims in the EAX paper. 

That said, in some cases there are additional security requirements for hiding the length of the plain text, by padding each message to a fixed length, but that falls outside of the scope of EAX, as well as most (all) other AEAD modes as well.