Skip to content

Commit b55c51f

Browse files
Change PKCS_RSA_PSS_SHA256 salt_len to 32
The default salt_len value for RSA PSS SHA256 is the current value, 20. However, the only application that we currently know can use the generated RSA PSS CSRs is Parsec https://github.com/parallaxsecond/parsec which requires a salt length of 32 to work with OPENSSL. * Change this value to 32 to be compatible with Parsec. On this topic, the spec states: "When signing, it is RECOMMENDED that the parameters, except for possibly saltLength, remain fixed for all usages of a given RSA key pair"; and this is the value we are changing. Signed-off-by: Tomás González <[email protected]>
1 parent cf26b59 commit b55c51f

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

rcgen/src/sign_algo.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ pub(crate) mod algo {
160160
params: SignatureAlgorithmParams::RsaPss {
161161
// id-sha256 in https://datatracker.ietf.org/doc/html/rfc4055#section-2.1
162162
hash_algorithm: &[2, 16, 840, 1, 101, 3, 4, 2, 1],
163-
salt_length: 20,
163+
salt_length: 32,
164164
},
165165
};
166166

0 commit comments

Comments
 (0)