Entropy in the implementation of Lua

[Steve Palmer <steve@...>]

Hi,

In Lua 5.4.4, the C functions "luai_makeseed" (in lstate.c) and 
"l_randomizePivot" (in ltablib.c) both seem to be trying to introduce 
some "unsigned int" sized entropy into Lua, both using "time(NULL)" 
(among other sources of entropy), and both working around uncertainty in 
the size of a "time_t" value.  They are also both protected by the 
PreProcessor directives (I guess) to allow alternative definitions.  
Curiously, "luai_makeseed" also uses the value of "L" and the address of 
the "lua_newstate" function to add entropy, while the "l_randomizePivot" 
uses the the c function "clock".  There is a similar function "randseed" 
(in "lmathlib.c"), though it is a little bit different, not being 
PreProcessor protected and attempting to generate more bits entropy, but 
from only "time(NULL)" and the value of "L".

My Use-Case is an attempt to port Lua on to a Raspberry Pi Pico 
microcontroller - a rather limited environment in which the C "time" 
function (and "clock" function) returns the error code -1 as allowed in 
the C standard (see https://en.cppreference.com/w/c/chrono/time).  On 
the other hand, like other microcontrollers, it has other sources of 
entropy.  In my case, there is a definite source of "random" bits, but 
on other Microcontrollers, one might try using the low order bits of 
some analogue signal input.

I know that randomness is a Huge topic, but my point is perhaps a bit 
simpler.  Could we tweak the Lua implementation to offer a single 
PreProcessor protected source of "unsigned int" sized entropy, that by 
default could use "time(NULL)" (among others) but for which ports to 
other platforms might provide an alternative source of entropy.  This 
function would replace "luai_makeseed" and "l_randomisePivot" and could 
be used by "randseed" instead of "time(NULL)".  It would also mean that 
there would be no loss of entropy if the C functions supported on the 
platform only returned the error code -1.

My unlikely worst-case-scenario is that lua's table.sort function is 
called, during which it repeatedly calls "l_randomizePivot" to provide 
alternative pivot points, but which keep returning the same value 
because "time" and "clock" are both returning -1.

Cheers,

Steve