Pad ciphertext with arbitrary number of bits I have a symmetric-key encryption scheme. I think the output from this scheme (MAC + IV + CBC ciphertext) should already be practically indistinguishable from random, but I would like to pad the output to an arbitrary number of bits and have it still look like noise (I will be using the output for steganography). It would also be fine to pad the input.

What is the best cipher to use for this?

It seems to be difficult to do with AES without putting a plaintext length somewhere in the output. Perhaps I could use a stream cipher where I can decrypt part of the message to find the length?
After a bit of additional reading I realized that appending noise to the ciphertext doesn't affect decryption of the plaintext part. The solution is therefore quite simple:

Encrypt length + plaintext with AES, then pad the ciphertext with as many random bits as necessary. HMAC the result including the random bits.

To get the plaintext back, first validate the MAC, then trim the ciphertext down to the nearest AES block size. You can then decrypt the result back to length + plaintext + garbage.