You could use a full Lua OpenSSL wrapper for this, if this dependency is acceptable to you.
It was not for one of my projects, so I have my collection of algorithms here:
It is based on a public domain C implementation offering CRC, MD2, MD5, SHA1, SHA256, AES, DES, BLOWFISH, RC4 wrapped to Lua. The selection was made based on the license and a minimalistic code base without dependencies. You could take this directory as the hash library (and ignore the rest of the repository).
In contrast, a pure Lua implementation would avoid the need of a C library completely, and from the performance point of view it's only relevant for large data.
