lightenModule

Encrypted Lua script support (AES-256-GCM).

This module provides functions to load and run encrypted Lua scripts using the darken C module.

The key is the module light, /lib/modules/lua/light.lua, which returns the hex-encoded 32-byte key; without it, require("lighten") raises “module ‘light’ not found”. tools/shade.sh darken [-s <secret>] <script>.lua encrypts a script into <script>.dark.lua, which calls what lighten.load returns with its own arguments, and prints the secret, 64 hex characters; tools/shade.sh lighten <secret> writes light.lua from it. With -t both derive the key from the current 30 second step, so light.lua and the dark script are generated in the same step:

SECRET=$(tools/shade.sh darken hello.lua)
tools/shade.sh lighten "$SECRET"
sudo cp light.lua hello.dark.lua /lib/modules/lua/
sudo lunatik run hello.dark

Functions

Functions in detail

load (ct, iv)

Decrypts and loads an encrypted Lua script without running it.

Parameters

• ct string Hex-encoded ciphertext followed by its 16-byte tag.
• iv string Hex-encoded 12-byte IV.

Returns

function the loaded script.

Raises

"invalid hexadecimal string" when ct, iv or the key is not hexadecimal of an even length, or the error darken.load raises.

See also

darken.load

run (ct, iv)

Decrypts and executes an encrypted Lua script.

Parameters

• ct string Hex-encoded ciphertext followed by its 16-byte tag.
• iv string Hex-encoded 12-byte IV.

Returns

The return values of the decrypted script.

Raises

"invalid hexadecimal string" when ct, iv or the key is not hexadecimal of an even length, or the error darken.run raises.

See also

darken.run