darkenModule
Encrypted Lua script execution using AES-256-GCM.
This module provides functionality to decrypt and execute Lua scripts encrypted with AES-256 in GCM mode. Scripts are decrypted in-kernel and executed immediately, with the decrypted plaintext never written to persistent storage.Functions
| run (ciphertext, iv, key) | Decrypts and executes an encrypted Lua script. |
Functions in detail
- run (ciphertext, iv, key)
-
Decrypts and executes an encrypted Lua script.
The ciphertext carries its 16-byte tag at the end and no associated data, and nothing is loaded
unless the tag matches. The decrypted script must be Lua source, and it runs with the runtime’s
global environment. It allocates a crypto transform, which may sleep: call it from a process
runtime or from a script body, never from a softirq or hardirq callback.
Parameters
- ciphertext string encrypted Lua script followed by its 16-byte tag (binary).
- iv string 12-byte initialization vector (binary).
- key string 32-byte AES-256 key (binary).
Returns
-
The return values from the executed script.
Raises
“IV must be 12 bytes”, “key must be 32 bytes”, “not allowed once the runtime is armed” from an interrupt-context runtime past its body, “EBADMSG” when the tag does not match (a wrong key or IV, or a ciphertext altered or shorter than the tag), the errno name of a failed transform allocation, key setting or decryption, “not enough memory”, the load error of the decrypted text (“attempt to load a binary chunk (mode is ’t')” for a precompiled script), or the error the script raises.