Merge pull request #391 from eclipse-threadx/devv6.5.1.202602_reldev

Merging changes for the v.6.5.1.202602 release

1 files changed, 12 insertions, 0 deletions

diff --git a/nx_secure/src/nx_secure_tls_process_clienthello_extensions.c b/nx_secure/src/nx_secure_tls_process_clienthello_extensions.c
index 34a551b2..ef5e70fa 100644
--- a/nx_secure/src/nx_secure_tls_process_clienthello_extensions.c
+++ b/nx_secure/src/nx_secure_tls_process_clienthello_extensions.c
@@ -1216,6 +1216,18 @@ VOID _nx_secure_tls_get_signature_algorithm_id(UINT signature_algorithm, USHORT
     case NX_SECURE_TLS_SIGNATURE_ECDSA_SHA512:
         *signature_algorithm_id = NX_SECURE_TLS_X509_TYPE_ECDSA_SHA_512;
         break;
+    /* RSASSA-PSS schemes (RFC 8446 §4.2.3). Mapped to the same internal IDs
+       as PKCS#1 v1.5 so the certificate cipher table lookup finds the (RSA,
+       SHA-x) pair. PSS-vs-PKCS1 dispatch is done at signature-verify time. */
+    case 0x0804u: /* rsa_pss_rsae_sha256 */
+        *signature_algorithm_id = NX_SECURE_TLS_X509_TYPE_RSA_SHA_256;
+        break;
+    case 0x0805u: /* rsa_pss_rsae_sha384 */
+        *signature_algorithm_id = NX_SECURE_TLS_X509_TYPE_RSA_SHA_384;
+        break;
+    case 0x0806u: /* rsa_pss_rsae_sha512 */
+        *signature_algorithm_id = NX_SECURE_TLS_X509_TYPE_RSA_SHA_512;
+        break;
     default:
         return;
     }