RE: Entropy in the implementation of Lua

[Roger Leigh <rleigh@...>]

Hi Steve,

I ran into this a few months back when getting Lua 5.4.4 to work on an STM32 microcontroller, where the time() function always returned zero due to the default C library implementation not being hooked up to the real-time clock.  Not so great for randomness, but then again time() isn't exactly great either--it would be nice to be able to use a better platform-specific implementation where possible, e.g. /dev/random on Linux, or /dev/hwrng on the Raspberry Pi.

My (platform-specific) solution was to replace this with a direct call to a hardware RNG and get a truly random number straight from the hardware.  Like you did, I defined "luai_makeseed" and "l_randomizePivot" to use my random function in both cases.

It would be really nice if this could be done with a single define to provide all random input for all Lua functions.  Or even a weak symbol that can be overridden by the end-user to provide a replacement without even needing to touch the original implementation.

Kind regards,
Roger

> -----Original Message-----
> From: Steve Palmer <steve@srpalmer.me.uk>
> Sent: Wednesday, March 15, 2023 9:45 AM
> To: lua-l@lists.lua.org
> Subject: Entropy in the implementation of Lua
> 
> Hi,
> 
> In Lua 5.4.4, the C functions "luai_makeseed" (in lstate.c) and
> "l_randomizePivot" (in ltablib.c) both seem to be trying to introduce some
> "unsigned int" sized entropy into Lua, both using "time(NULL)"
> (among other sources of entropy), and both working around uncertainty in
> the size of a "time_t" value.  They are also both protected by the PreProcessor
> directives (I guess) to allow alternative definitions. Curiously,
> "luai_makeseed" also uses the value of "L" and the address of the
> "lua_newstate" function to add entropy, while the "l_randomizePivot"
> uses the the c function "clock".