gcrypt: Add support for static salts when signing with RSA-PSS

diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c b/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c
index 5dc0bfd30ff3e98ea468058e8b23807574ed3827..c06f433485d2b2f568daa5a4a32a01ee80ebac5c 100644 (file)
--- a/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c
+++ b/src/libstrongswan/plugins/gcrypt/gcrypt_rsa_private_key.c
@@ -177,14 +177,25 @@ static bool sign_pkcs1(private_gcrypt_rsa_private_key_t *this,
 
        if (pss)
        {
-               u_int slen = hasher_hash_size(hash_algorithm);
-               if (pss->salt_len > RSA_PSS_SALT_LEN_DEFAULT)
+               if (pss->salt.len)
                {
-                       slen = pss->salt_len;
+                       err = gcry_sexp_build(&in, NULL,
+                                                       "(data(flags pss)(salt-length %u)"
+                                                       "(random-override %b)(hash %s %b))",
+                                                       pss->salt.len, pss->salt.len, pss->salt.ptr,
+                                                       hash_name, hash.len, hash.ptr);
+               }
+               else
+               {
+                       u_int slen = hasher_hash_size(hash_algorithm);
+                       if (pss->salt_len > RSA_PSS_SALT_LEN_DEFAULT)
+                       {
+                               slen = pss->salt_len;
+                       }
+                       err = gcry_sexp_build(&in, NULL,
+                                                       "(data(flags pss)(salt-length %u)(hash %s %b))",
+                                                       slen, hash_name, hash.len, hash.ptr);
                }
-               err = gcry_sexp_build(&in, NULL,
-                                                         "(data(flags pss)(salt-length %u)(hash %s %b))",
-                                                         slen, hash_name, hash.len, hash.ptr);
        }
        else
        {