Luau Cryptography is a library of cryptographic algorithims written in Luau. It supports Post-Quantum (PQ), Elliptic Curve Cryptography (ECC), authenticated encryption and CSPRNG with many utilities.
daily3014 - Developer - @daily3014
Xoifail - Developer - @xoifail
- Thanks to those who gave feedback and testing
- Special thanks to all contributors and bug reporters
- AES was originally made by @RobloxGamerPro200007
- XChaCha20 was originally made by @littleBitsman
- Murmur3 hash was originally made by @kohltastrophe
While this library has extensive testing, it's always recommended that you do your own tests. Keep in mind that there may be timing vulnerabilities that cannot be fixed due to how Luau compiles functions. This library is NOT intended for exploitation, harassment, illegal activities, or explicit content. All security issues should be reported in the Discord server.
[dependencies]
cryptography = "daily3014/cryptography@3.1.4"pesde add daily3014/cryptographyDownload the latest release from GitHub and place it in your Roblox Studio project.
Digital Signature Schemes
- Ed25519 signatures with masked operations for side-channel protection
Key Exchange
- X25519: Elliptic curve Diffie-Hellman over Curve25519
KEM: Key Encapsulation Methods
- ML-KEM: modes 512, 768, 1024 (Kyber-based, NIST standardized)
Digital Signature Schemes
Hash Functions
- SHA-2 Family: SHA-224, SHA-256, SHA-384, SHA-512, SHA-512/224, SHA-512/256 with optional salt support
- SHA-3 Family: SHA3-224, SHA3-256, SHA3-384, SHA3-512, SHAKE-128, SHAKE-256 (FIPS 202)
- BLAKE Family: BLAKE3 (fastest available), BLAKE3-Keyed, BLAKE3-DeriveKey, BLAKE2b
Non-cryptographic Hash Functions
Message Authentication
-
HMAC: Hash-based Message Authentication Code (works with any hash function)
-
KMAC: Hash-based Message Authentication Code (uses Keccak)
Authenticated Encryption
- ChaCha20-Poly1305: AEAD construction (RFC 8439)
- AES-GCM: Galois/Counter Mode
Stream & Block Ciphers
- ChaCha20: Stream cipher (RFC 8439)
- AES-GCM: Advanced Encryption Standard
- Simon: Lightweight block cipher
- Speck: Lightweight block cipher
- XOR: Simple additive cipher
Checksums
Encoding & Conversion
- Base64: Encode and decode
- Hexadecimal: Buffer to/from hex string conversion
Random Generation
- CSPRNG: Cryptographically Secure Pseudo-Random Number Generator with entropy management
- Random strings and bytes generation
Performance benchmarks conducted in Roblox Studio on AMD Ryzen 5 7600X using Benchmarker by @boatbomber.
| Algorithm | Data Size | This Library | HashLib | Alternative | Other Libraries | Improvement |
|---|---|---|---|---|---|---|
| SHA-256 | 20k | 271 μs | 2058 μs | 493 μs (Old Version) | 596 μs (Dekkonot) | 7.6x faster than HashLib |
| SHA-512 | 20k | 421 μs | 4348 μs | 1066 μs (Dekkonot) | - | 10.3x faster than HashLib |
| SHA3-512 | 20k | 826 μs | 10.60 ms | - | - | 12.8x faster than HashLib |
| BLAKE3 | 20k | 133 μs | - | - | - | - |
| HMAC-BLAKE3 | 20k | 145 μs | - | - | - | - |
| KMAC-128 | 20k | 443 μs | - | - | - | - |
| KMAC-256 | 20k | 501 μs | - | - | - | - |
| Adler-32 | 200k | 163 μs | - | 1.65 ms (Naive Approach) | - | 10.1x faster |
| CRC32 | 200k | 1.43 ms | - | 6.26 ms (DevForum) | - | 4.4x faster |
| Algorithm | Data Size | This Library | Alternative | Other Libraries | Improvement |
|---|---|---|---|---|---|
| ChaCha20 (Encrypt) | 20k | 177 μs | 7.87 ms (EncryptedNet) | - | 44.5x faster |
| ChaCha20 (Roundtrip) | 20k | 338 μs | ~15 ms (EncryptedNet) | - | 44.4x faster |
| ChaCha20-Poly1305 (Encrypt) | 20k | 232 μs | - | - | - |
| ChaCha20-Poly1305 (Roundtrip) | 20k | 448 μs | - | - | - |
| Simon (Encrypt) | 20k | 239 μs | - | - | - |
| Simon (Roundtrip) | 20k | 466 μs | - | - | - |
| Speck (Encrypt) | 20k | 193 μs | - | - | - |
| Speck (Roundtrip) | 20k | 388 μs | - | - | - |
| AES-GCM (Encrypt) | 20k | 833 μs | 1.877 ms (RobloxGamerPro200007 AES256-CTR) | - | 2.3x faster |
| AES-GCM (Roundtrip) | 20k | 1.5 ms | - | - | - |
| XOR (Encrypt) | 1 million | 1.10 ms | ~49.5 ms (Devfourm) | ~171000 ms (daily) | 155,454x faster |
| XOR (Roundtrip) | 1 million | 2.20 ms | 98.9 ms (Devfourm) | ~342000 ms (daily) | 155,454x faster |
| Algorithm | Operation | Time | Alternative | Improvement |
|---|---|---|---|---|
| EdDSA (Roundtrip) | Sign+Verify | 691 μs | - | - |
| ML-DSA-44 (Roundtrip) | Sign+Verify | 3.65 ms | - | - |
| ML-KEM-512 (Roundtrip) | Encap+Decap | 754 μs | - | - |
| Algorithm | Data Size | Time | Alternative | Improvement |
|---|---|---|---|---|
| Base64 (Roundtrip) | 1 million | 3.77ms | Lute: 9.11ms Reselim: 12.08ms |
2.4x faster than Lute 3.2x faster than Reselim |
Roundtrip: Complete encrypt/decrypt or sign/verify cycle
To run the complete test suite:
bash scripts/test.shThis will launch Roblox Studio, execute all tests, and display results in your terminal.
For continuous testing during development:
bash scripts/dev.shThis starts a Rojo server. Open Roblox Studio and sync Rojo into a Baseplate. Whenever you run the game server, the test suites will run and results will show in the Output widget.
To contribute, fork this repository and make your changes, and then make a Pull Request. A Pull Request needs approval.
Please read the CONTRIBUTING.md file for detailed guidelines.
This project is licensed under the MIT License. See the LICENSE file for details.