lua-users home
lua-l archive

[Date Prev][Date Next][Thread Prev][Thread Next] [Date Index] [Thread Index]

Thanks Tom & Pierre for your inputs.

Pierre - I checked #1 & #2 library given by you & their docs mention dependency for Lua >= 5.3 & Lua >=5.2 

I have Lua 5.1 on my machines & if i'm not wrong #1 & #2 libraries won't work with Lua 5.1 (FYI - i tried #2 library on my machines with Lua 5.1 & getting this error "no bitwise support found" which as per this doc is due to Lua version 5.1 not having bitwise support).

Do you have any suggestions for Lua 5.1 ?

On Sun, Feb 7, 2021 at 12:02 AM Pierre Chapuis <> wrote:
I agree with Tom, if you must do crypto "online" (i.e. for instance in a Web server) then you must rely on C bindings. Pure Lua crypto can be used for "offline" things e.g. to encrypt or decrypt a file sent / received by email, since this is not vulnerable to things like timing attacks. And even then, Lua crypto library are much less audited than C libraries, so use bindings when you can. In case you really need one, the two relatively serious pure Lua crypto libraries I know are plc [1] and lockbox [2].

I agree that libsodium would be the best option, but sadly I just don't know a generic, battle-tested binding for Lua. If you go the OpenSSL route, the "openssl" and "luaossl" rocks [3] [4] are reliable (or LuaSec if you just need TLS).


Pierre Chapuis

On Sat, Feb 6, 2021, at 18:38, Tom Sutcliffe wrote:
> Given a clean slate and no specific constraints, I'm a fan of libsodium
> which has an approachable API that's hard to
> mess up (from a security point of view, I mean).
> I'm sure there are probably others, but there are some Lua bindings to
> a subset of the libsodium API in NodeMCU which might be useful, if only
> as an example:
> As a general rule, doing cryptography right is _extremely_ difficult
> and I would be cautious of any implementation written in Lua (or
> _javascript_, or Python, etc). There's a reason OpenSSL, libsodium,
> GnuPG/libcrypto etc are all written in C. Examples of things you might
> not realise compromise your security are things like timing attacks,
> the C implementation of libsodium (to take one example) takes care to
> avoid falling foul of CPU branch prediction by avoiding conditional
> branches on critical code paths. The odds of that kind of thing
> surviving being translated into another language are extremely low. For
> example, in _javascript_ your code may get JITted at runtime which could
> utterly destroy timing attack defences.
> So whatever solution you go with, I'd recommend one written in C with
> Lua bindings. Under no circumstances should you be tempted to "roll
> your own" cryptography. You will get it wrong.
> As others have said however, picking the "right" crypto for a
> particular situation is a bit of a minefield, it's a very complex
> subject, many solutions have tradeoffs that aren't always obvious or
> well documented, and very few people truly understand every nuance.
> Myself included! Given all that, I'm hesitant to provide any specific
> recommendations.
> Regards,
> Tom
> > On 4 Feb 2021, at 6:07 am, Vishnu exer <> wrote:
> >
> > Hello everyone,
> >
> > My requirement is to do encryption in Lua for a production system.
> >
> > For doing this i'm exploring below 2 ways.
> >
> > 1) Use encryption library already implemented in Lua
> > 2) Use C/C++/C#/Java (or any other language) encryption library which can be called from Lua
> >
> > Can you please help me with your inputs on some encryption libraries which can be used in a Lua production system ?
> >
> > Thanks
> > Vishnu