This is definitely a nice reference implementation of crypto algorithms in pure Lua, but please, please do not use it for production encryption. Anything written in an interpreted (or worse, JIT-ted) language will be almost definitely vulnerable to timing attacks. Lua already has bindings to C/C++ crypto libraries if you need to encrypt or create MACs.