crypt
Cryptographic primitives (hashing, HMAC, AES/ChaCha20/AEAD ciphers, Blake2b/Blake3, Ed25519/X25519, base64/hex, random bytes) exposed to scripts.
Hashing
Section titled “Hashing”crypt.Hash
Section titled “crypt.Hash”crypt.Hash(data: string, algo: string): string
Hashes data with the named algorithm (sha1, sha256, sha384, sha512, md5) and returns the digest as a hex string.
local h = crypt.Hash("hello", "sha256")crypt.HashToBuffer
Section titled “crypt.HashToBuffer”crypt.HashToBuffer(data: string, algo: string): string
Hashes data with the named algorithm and returns the raw binary digest instead of hex.
local raw = crypt.HashToBuffer("hello", "sha256")crypt.Hmac
Section titled “crypt.Hmac”crypt.Hmac(data: string, key: string, algo: string): string
Computes an HMAC over data with the given key and algorithm, returned as a hex string.
local mac = crypt.Hmac("msg", "secretkey", "sha256")crypt.HmacToBuffer
Section titled “crypt.HmacToBuffer”crypt.HmacToBuffer(data: string, key: string, algo: string): string
Computes an HMAC over data with the given key and algorithm, returned as raw binary.
local mac = crypt.HmacToBuffer("msg", "secretkey", "sha256")crypt.Blake2b
Section titled “crypt.Blake2b”crypt.Blake2b(data: string, key: string?, outLen: number?): string
Computes a keyed or unkeyed BLAKE2b hash of data, returning raw bytes of the requested length (clamped to libsodium’s min and max, default 32).
local digest = crypt.Blake2b("data")crypt.Blake3
Section titled “crypt.Blake3”crypt.Blake3(data: string): string
Computes a 32 byte BLAKE3 hash of data and returns it as a hex string.
local h = crypt.Blake3("data")crypt.Blake3ToBuffer
Section titled “crypt.Blake3ToBuffer”crypt.Blake3ToBuffer(data: string): string
Computes a 32 byte BLAKE3 hash of data and returns it as raw binary.
local raw = crypt.Blake3ToBuffer("data")crypt.Blake3Keyed
Section titled “crypt.Blake3Keyed”crypt.Blake3Keyed(data: string, key: string): string
Computes a keyed 32 byte BLAKE3 hash of data (key zero-padded or truncated to 32 bytes) and returns it as a hex string.
local h = crypt.Blake3Keyed("data", key)Encoding
Section titled “Encoding”crypt.Base64Encode
Section titled “crypt.Base64Encode”crypt.Base64Encode(data: string): string
Encodes a string as standard base64.
local b64 = crypt.Base64Encode("hello")crypt.Base64Decode
Section titled “crypt.Base64Decode”crypt.Base64Decode(data: string): string
Decodes a standard base64 string back to raw bytes.
local raw = crypt.Base64Decode(b64)crypt.HexEncode
Section titled “crypt.HexEncode”crypt.HexEncode(data: string): string
Encodes a string as lowercase hexadecimal.
local hex = crypt.HexEncode("hello")crypt.HexDecode
Section titled “crypt.HexDecode”crypt.HexDecode(data: string): string
Decodes a hexadecimal string back to raw bytes.
local raw = crypt.HexDecode(hex)Random & keys
Section titled “Random & keys”crypt.Random
Section titled “crypt.Random”crypt.Random(count: number): string
Returns count cryptographically random bytes as a string. Negative counts are clamped to 0.
local r = crypt.Random(16)crypt.GenerateKey
Section titled “crypt.GenerateKey”crypt.GenerateKey(): string
Generates 32 random bytes and returns them base64 encoded, suitable for use as a key.
local key = crypt.GenerateKey()crypt.GenerateBytes
Section titled “crypt.GenerateBytes”crypt.GenerateBytes(count: number): string
Returns count cryptographically random bytes as a string. Negative counts are clamped to 0.
local b = crypt.GenerateBytes(24)Symmetric encryption
Section titled “Symmetric encryption”crypt.EncryptAesCbc
Section titled “crypt.EncryptAesCbc”crypt.EncryptAesCbc(plaintext: string, key: string, iv: string): string
Encrypts plaintext with AES-CBC using a 16, 24 or 32 byte key and a 16 byte IV, returning raw ciphertext.
local ct = crypt.EncryptAesCbc("data", key16, iv16)crypt.DecryptAesCbc
Section titled “crypt.DecryptAesCbc”crypt.DecryptAesCbc(ciphertext: string, key: string, iv: string): string
Decrypts AES-CBC ciphertext using a 16, 24 or 32 byte key and a 16 byte IV, returning raw plaintext.
local pt = crypt.DecryptAesCbc(ct, key16, iv16)crypt.EncryptAesGcm
Section titled “crypt.EncryptAesGcm”crypt.EncryptAesGcm(plaintext: string, key: string, iv: string, aad: string?): (ciphertext: string, tag: string)
Encrypts plaintext with AES-GCM using the given key and non-empty IV and optional additional authenticated data, returning the ciphertext and a 16 byte auth tag.
local ct, tag = crypt.EncryptAesGcm("data", key32, iv12)crypt.DecryptAesGcm
Section titled “crypt.DecryptAesGcm”crypt.DecryptAesGcm(ciphertext: string, key: string, iv: string, tag: string, aad: string?): string?
Decrypts AES-GCM ciphertext and verifies the auth tag, returning nil if the tag does not match (tampered or wrong key).
local pt = crypt.DecryptAesGcm(ct, key32, iv12, tag)crypt.Encrypt
Section titled “crypt.Encrypt”crypt.Encrypt(plaintext: string, base64Key: string): (base64Ciphertext: string, base64Iv: string)
Legacy AES-CBC helper that base64-decodes the key, pads or truncates it to 32 bytes, generates a random 16 byte IV, and returns base64 ciphertext and IV.
local ct, iv = crypt.Encrypt("data", crypt.GenerateKey())crypt.Decrypt
Section titled “crypt.Decrypt”crypt.Decrypt(base64Ciphertext: string, base64Key: string, base64Iv: string): string
Legacy AES-CBC helper that base64-decodes ciphertext, key (padded or truncated to 32 bytes) and IV, and returns the raw plaintext.
local pt = crypt.Decrypt(ct, key, iv)crypt.ChaCha20
Section titled “crypt.ChaCha20”crypt.ChaCha20(data: string, key: string, nonce: string, counter: number?): string
Encrypts or decrypts data with the ChaCha20 stream cipher using a 32 byte key, a nonce (up to 12 bytes), and an optional initial block counter (default 0).
local out = crypt.ChaCha20("data", key32, nonce12)crypt.ChaCha20Poly1305Encrypt
Section titled “crypt.ChaCha20Poly1305Encrypt”crypt.ChaCha20Poly1305Encrypt(plaintext: string, key: string, nonce: string, aad: string?): string
Encrypts plaintext with ChaCha20-Poly1305 AEAD using a fixed size key and nonce and optional additional authenticated data, returning ciphertext with the tag appended.
local ct = crypt.ChaCha20Poly1305Encrypt("data", key32, nonce12)crypt.ChaCha20Poly1305Decrypt
Section titled “crypt.ChaCha20Poly1305Decrypt”crypt.ChaCha20Poly1305Decrypt(ciphertext: string, key: string, nonce: string, aad: string?): string?
Decrypts and verifies a ChaCha20-Poly1305 ciphertext (with appended tag), returning nil on authentication failure.
local pt = crypt.ChaCha20Poly1305Decrypt(ct, key32, nonce12)Signing & key exchange
Section titled “Signing & key exchange”crypt.Ed25519Keypair
Section titled “crypt.Ed25519Keypair”crypt.Ed25519Keypair(): (publicKey: string, secretKey: string)
Generates a new Ed25519 keypair and returns the raw public and secret keys.
local pk, sk = crypt.Ed25519Keypair()crypt.Ed25519Sign
Section titled “crypt.Ed25519Sign”crypt.Ed25519Sign(message: string, secretKey: string): string
Signs a message with an Ed25519 secret key and returns the detached signature.
local sig = crypt.Ed25519Sign("msg", sk)crypt.Ed25519Verify
Section titled “crypt.Ed25519Verify”crypt.Ed25519Verify(message: string, signature: string, publicKey: string): boolean
Verifies an Ed25519 detached signature against a message and public key.
local ok = crypt.Ed25519Verify("msg", sig, pk)crypt.X25519Keypair
Section titled “crypt.X25519Keypair”crypt.X25519Keypair(): (publicKey: string, secretKey: string)
Generates a new X25519 keypair for elliptic curve Diffie-Hellman and returns the raw public and secret keys.
local pk, sk = crypt.X25519Keypair()crypt.X25519SharedSecret
Section titled “crypt.X25519SharedSecret”crypt.X25519SharedSecret(secretKey: string, peerPublicKey: string): string?
Computes the X25519 shared secret from your secret key and a peer’s public key, returning nil on failure.
local shared = crypt.X25519SharedSecret(sk, peerPk)