diff --git a/jni/jni_feature_detect.c b/jni/jni_feature_detect.c index ee0bfa1d..cc19bc1a 100644 --- a/jni/jni_feature_detect.c +++ b/jni/jni_feature_detect.c @@ -527,7 +527,11 @@ JNIEXPORT jboolean JNICALL Java_com_wolfssl_wolfcrypt_FeatureDetect_RsaPssLongSa { (void)env; (void)jcl; -#if !defined(NO_RSA) && defined(WC_RSA_PSS) && defined(WOLFSSL_PSS_LONG_SALT) +/* FIPS v7 and later cap the PSS salt at the digest length, even when + * WOLFSSL_PSS_LONG_SALT is defined */ +#if !defined(NO_RSA) && defined(WC_RSA_PSS) && \ + defined(WOLFSSL_PSS_LONG_SALT) && \ + !(defined(HAVE_FIPS_VERSION) && (HAVE_FIPS_VERSION >= 7)) return JNI_TRUE; #else return JNI_FALSE; diff --git a/src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java b/src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java index a989fcc8..88a81db2 100644 --- a/src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java +++ b/src/main/java/com/wolfssl/wolfcrypt/FeatureDetect.java @@ -326,10 +326,10 @@ public class FeatureDetect { public static native boolean RsaPssEnabled(); /** - * Tests if RSA-PSS salt lengths longer than the digest are compiled into - * the native wolfSSL library (WOLFSSL_PSS_LONG_SALT). + * Tests if RSA-PSS salt lengths longer than the digest are supported by + * the native wolfSSL library. * - * @return true if enabled, otherwise false if not compiled in. + * @return true if supported, otherwise false. */ public static native boolean RsaPssLongSaltEnabled(); diff --git a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java index 3df3f516..1f3400f8 100644 --- a/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java +++ b/src/test/java/com/wolfssl/provider/jce/test/WolfCryptSignatureTest.java @@ -1821,7 +1821,7 @@ public class WolfCryptSignatureTest { if (!FeatureDetect.RsaPssLongSaltEnabled()) { System.out.println("\tSkipping max salt lengths, " + - "WOLFSSL_PSS_LONG_SALT not compiled in"); + "long PSS salts not supported by native wolfSSL"); return; } @@ -2218,7 +2218,7 @@ public class WolfCryptSignatureTest { /* Uses the maximum salt length for each digest */ if (!FeatureDetect.RsaPssLongSaltEnabled()) { System.out.println( - "\tSkipping, WOLFSSL_PSS_LONG_SALT not compiled in"); + "\tSkipping, long PSS salts not supported by native wolfSSL"); return; }