crypto/rsa: pss may have wrong salt length

[zhangzhanli]

crypto/rsa/pss.go : 272 in latest version of go

When PSSOptions's saltLength is PSSSaltLengthAuto, we just try to maximize the length of salt. But there are some problems with it where the bit length of N of private key is congruent to 1 module 8. (i.e. bitlen(N) == 8k + 1) . Under these situations, when checking emLen in crypto/rsa/pss.go : 50 which is equal to hLen+sLen+1, we will alway get an error "key size too small for PSS signature". And I didn't see there are such problems with openssl. So, maybe we need a change?

[martisch]

Cc @FiloSottile

[FiloSottile]

Yep, this is broken and has been broken at least since Go 1.13, so not a Go 1.16 fix. Scheduling for 1.17, thank you!

https://play.golang.org/p/hgTw2zJW2OI