@@ -177,6 +177,17 @@ reporting or the Eclipse Foundation security team — and which versions receive
 
 ### Fixed
 
+- **RSA-PSS options are checked before reaching the token.** A negative `PSSOptions.SaltLength`
+  other than the two sentinels made `Sign` panic, since pkcs11-go's `NewPSSParams` panics on a
+  negative salt. It is now an error wrapping `errUnsupportedRSAOptions`, as crypto/rsa makes it.
+  An explicit salt longer than the modulus can carry is `rsa.ErrMessageTooLong`, again as in
+  crypto/rsa, and a digest whose length is not the hash's size is an error rather than something
+  left to the token, matching the PKCS#1 v1.5 path.
+- **HMAC.** `NewHMAC` reported a `BlockSize` of 64 for `CKM_SHA384_HMAC` and
+  `CKM_SHA384_HMAC_GENERAL`; SHA-384's block size is 128. For a `_GENERAL` mechanism it accepted
+  any output length: 0 made every `Sum` panic on the empty MAC, and a negative length reached the
+  token as a huge `CK_ULONG`. Lengths outside 1 to the hash's full size are now rejected with
+  `errInvalidMACLength`. The size table is tested against Go's own hash implementations.
 - Key enumeration no longer aborts on a key type the package cannot represent
   ([#68](https://github.com/eclipse-keypont/crypto11/issues/68), reported by
   [@Knacktus](https://github.com/Knacktus) and independently run into by
 
@@ -102,8 +102,8 @@ var hmacInfos = map[int]*hmacInfo{
 	pkcs11.CKM_SHA224_HMAC_GENERAL:     {28, 64, true},
 	pkcs11.CKM_SHA256_HMAC:             {32, 64, false},
 	pkcs11.CKM_SHA256_HMAC_GENERAL:     {32, 64, true},
-	pkcs11.CKM_SHA384_HMAC:             {48, 64, false},
-	pkcs11.CKM_SHA384_HMAC_GENERAL:     {48, 64, true},
+	pkcs11.CKM_SHA384_HMAC:             {48, 128, false},
+	pkcs11.CKM_SHA384_HMAC_GENERAL:     {48, 128, true},
 	pkcs11.CKM_SHA512_HMAC:             {64, 128, false},
 	pkcs11.CKM_SHA512_HMAC_GENERAL:     {64, 128, true},
 	pkcs11.CKM_SHA512_224_HMAC:         {28, 128, false},
@@ -117,9 +117,14 @@ var hmacInfos = map[int]*hmacInfo{
 // errHmacClosed is called if an HMAC is updated after it has finished.
 var errHmacClosed = errors.New("already called Sum()")
 
+// errInvalidMACLength is returned by NewHMAC for an output length the
+// mechanism cannot produce.
+var errInvalidMACLength = errors.New("invalid MAC length")
+
 // NewHMAC returns a new HMAC hash using the given PKCS#11 mechanism
 // and key.
-// length specifies the output size, for _GENERAL mechanisms.
+// length specifies the output size, for _GENERAL mechanisms: between 1 and the
+// full MAC size of the underlying hash.
 //
 // If the mechanism is not in the built-in list of known mechanisms then the
 // Size() function will return whatever length was, even if it is wrong.
@@ -144,12 +149,20 @@ func (key *SecretKey) NewHMAC(mech int, length int) (hash.Hash, error) {
 	if info, ok := hmacInfos[mech]; ok {
 		hi.blockSize = info.blockSize
 		if info.general {
+			// A zero length would make every Sum panic on the empty MAC, and a
+			// negative one would reach the token as a huge CK_ULONG.
+			if length < 1 || length > info.size {
+				return nil, fmt.Errorf("%w: %d bytes; mechanism %#x produces 1 to %d", errInvalidMACLength, length, mech, info.size)
+			}
 			hi.size = length
 			params = pkcs11.ULongToBytes(uint(length))
 		} else {
 			hi.size = info.size
 		}
 	} else {
+		if length < 0 {
+			return nil, fmt.Errorf("%w: %d bytes", errInvalidMACLength, length)
+		}
 		hi.size = length
 	}
 	hi.mechDescription = pkcs11.NewMechanism(uint(mech), params)
 
@@ -6,7 +6,12 @@ package crypto11
 
 import (
 	"bytes"
+	"crypto/md5"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/sha512"
 	"errors"
+	"hash"
 	"sync"
 	"testing"
 	"time"
@@ -282,14 +287,51 @@ func TestCheckMACLength(t *testing.T) {
 }
 
 func TestHmacInfoSizesMatchDigests(t *testing.T) {
-	// The table is what Sum validates token output against, so an entry that
-	// is wrong (MD5 was listed at 20 bytes) would reject every correct MAC.
-	assert.Equal(t, 16, hmacInfos[pkcs11.CKM_MD5_HMAC].size)
-	assert.Equal(t, 20, hmacInfos[pkcs11.CKM_SHA_1_HMAC].size)
-	assert.Equal(t, 28, hmacInfos[pkcs11.CKM_SHA224_HMAC].size)
-	assert.Equal(t, 32, hmacInfos[pkcs11.CKM_SHA256_HMAC].size)
-	assert.Equal(t, 48, hmacInfos[pkcs11.CKM_SHA384_HMAC].size)
-	assert.Equal(t, 64, hmacInfos[pkcs11.CKM_SHA512_HMAC].size)
+	// The table is what Sum validates token output against, so a wrong size
+	// (MD5 was listed at 20 bytes) rejects every correct MAC; and its block size
+	// is what BlockSize reports (SHA-384 was listed at 64 bytes, not 128). Both
+	// are checked against Go's own implementation of each hash.
+	hashes := map[int]func() hash.Hash{
+		pkcs11.CKM_MD5_HMAC:        md5.New,
+		pkcs11.CKM_SHA_1_HMAC:      sha1.New,
+		pkcs11.CKM_SHA224_HMAC:     sha256.New224,
+		pkcs11.CKM_SHA256_HMAC:     sha256.New,
+		pkcs11.CKM_SHA384_HMAC:     sha512.New384,
+		pkcs11.CKM_SHA512_HMAC:     sha512.New,
+		pkcs11.CKM_SHA512_224_HMAC: sha512.New512_224,
+		pkcs11.CKM_SHA512_256_HMAC: sha512.New512_256,
+	}
+	// Each _GENERAL mechanism is its plain one plus one.
+	for mech, newHash := range hashes {
+		h := newHash()
+		for _, m := range []int{mech, mech + 1} {
+			info, ok := hmacInfos[m]
+			require.True(t, ok, "mechanism %#x missing from hmacInfos", m)
+			assert.Equal(t, h.Size(), info.size, "size of %#x", m)
+			assert.Equal(t, h.BlockSize(), info.blockSize, "block size of %#x", m)
+			assert.Equal(t, m == mech+1, info.general, "general flag of %#x", m)
+		}
+	}
+	// RIPEMD-160 has no implementation in the standard library.
+	assert.Equal(t, 20, hmacInfos[pkcs11.CKM_RIPEMD160_HMAC].size)
+	assert.Equal(t, 64, hmacInfos[pkcs11.CKM_RIPEMD160_HMAC].blockSize)
+}
+
+func TestNewHMACRejectsInvalidLength(t *testing.T) {
+	// The length is checked before a session is taken, so no token is needed.
+	key := &SecretKey{}
+	for _, c := range []struct {
+		mech, length int
+	}{
+		{pkcs11.CKM_SHA256_HMAC_GENERAL, 0},
+		{pkcs11.CKM_SHA256_HMAC_GENERAL, -1},
+		{pkcs11.CKM_SHA256_HMAC_GENERAL, 33},
+		{pkcs11.CKM_SHA_1_HMAC_GENERAL, 21},
+		{pkcs11.CKM_VENDOR_DEFINED, -1}, // not in the table
+	} {
+		_, err := key.NewHMAC(c.mech, c.length)
+		require.ErrorIs(t, err, errInvalidMACLength, "mechanism %#x, length %d", c.mech, c.length)
+	}
 }
 
 func TestHmacResetAfterDeadOperationDoesNotPanic(t *testing.T) {
 
@@ -573,21 +573,41 @@ func maxPSSSaltLength(pubKey crypto.PublicKey, hLen uint) (uint, error) {
 	return uint(sLen), nil
 }
 
+// pssSaltLength resolves opts.SaltLength to the salt length handed to the
+// token, rejecting what crypto/rsa rejects: a negative length other than the
+// two sentinels, and a salt longer than the modulus can carry. The second check
+// needs the public key; without one (a key found by FindRSAPrivateKey, say) an
+// explicit length is left to the token to judge.
+func pssSaltLength(pubKey crypto.PublicKey, saltLength int, hLen uint) (uint, error) {
+	switch saltLength {
+	case rsa.PSSSaltLengthAuto:
+		return maxPSSSaltLength(pubKey, hLen)
+	case rsa.PSSSaltLengthEqualsHash:
+		return hLen, nil
+	}
+	if saltLength < 0 {
+		return 0, fmt.Errorf("%w: PSS salt length %d", errUnsupportedRSAOptions, saltLength)
+	}
+	sLen := uint(saltLength)
+	if limit, err := maxPSSSaltLength(pubKey, hLen); err == nil && sLen > limit {
+		return 0, rsa.ErrMessageTooLong
+	}
+	return sLen, nil
+}
+
 func signPSS(session *pkcs11Session, key *pkcs11PrivateKeyRSA, digest []byte, opts *rsa.PSSOptions) ([]byte, error) {
 	var hMech, mgf, hLen, sLen uint
 	var err error
 	if hMech, mgf, hLen, err = hashToPKCS11(opts.Hash); err != nil {
 		return nil, err
 	}
-	switch opts.SaltLength {
-	case rsa.PSSSaltLengthAuto:
-		if sLen, err = maxPSSSaltLength(key.pubKey, hLen); err != nil {
-			return nil, err
-		}
-	case rsa.PSSSaltLengthEqualsHash:
-		sLen = hLen
-	default:
-		sLen = uint(opts.SaltLength)
+	// CKM_RSA_PKCS_PSS signs a digest it is told the hash of; one of another
+	// length is a caller error, reported as signPKCS1v15 reports it.
+	if len(digest) != int(hLen) {
+		return nil, fmt.Errorf("digest is %d bytes; %v produces %d", len(digest), opts.Hash, hLen)
+	}
+	if sLen, err = pssSaltLength(key.pubKey, opts.SaltLength, hLen); err != nil {
+		return nil, err
 	}
 	// The binding marshals CK_RSA_PKCS_PSS_PARAMS itself, so we no longer have
 	// to hand-pack three CK_ULONGs and hope the layout matches the token's.
 
@@ -145,6 +145,61 @@ func testRsaSigningPSS(t *testing.T, key crypto.Signer, hashFunction crypto.Hash
 			require.NoError(t, err)
 		})
 	}
+
+	// Bad options are errors, as crypto/rsa makes them, not panics: the
+	// binding's NewPSSParams panics on a negative salt length.
+	badOptions := map[string]struct {
+		digest []byte
+		opts   *rsa.PSSOptions
+	}{
+		"NegativeSaltLength": {plaintextHash, &rsa.PSSOptions{SaltLength: -2, Hash: hashFunction}},
+		"OversizedSalt":      {plaintextHash, &rsa.PSSOptions{SaltLength: rsaPubkey.Size(), Hash: hashFunction}},
+		"WrongDigestLength":  {plaintextHash[1:], &rsa.PSSOptions{SaltLength: rsa.PSSSaltLengthEqualsHash, Hash: hashFunction}},
+	}
+	for name, bad := range badOptions {
+		t.Run(name, func(t *testing.T) {
+			var err error
+			require.NotPanics(t, func() { _, err = key.Sign(rand.Reader, bad.digest, bad.opts) })
+			require.Error(t, err)
+		})
+	}
+}
+
+// TestPSSSaltLength checks how PSSOptions.SaltLength is resolved before it
+// reaches the token, without needing one.
+func TestPSSSaltLength(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	require.NoError(t, err)
+	const hLen = 32
+	limit := uint(256 - 2 - hLen)
+
+	for _, c := range []struct {
+		name       string
+		pub        crypto.PublicKey
+		saltLength int
+		want       uint
+		wantErr    error
+	}{
+		{"Auto", &key.PublicKey, rsa.PSSSaltLengthAuto, limit, nil},
+		{"EqualsHash", &key.PublicKey, rsa.PSSSaltLengthEqualsHash, hLen, nil},
+		{"Explicit", &key.PublicKey, 20, 20, nil},
+		{"ExplicitMaximum", &key.PublicKey, int(limit), limit, nil},
+		{"ExplicitTooLong", &key.PublicKey, int(limit) + 1, 0, rsa.ErrMessageTooLong},
+		{"Negative", &key.PublicKey, -2, 0, errUnsupportedRSAOptions},
+		// Without a public key only the token can judge an explicit length.
+		{"ExplicitNoPublicKey", nil, 20, 20, nil},
+		{"AutoNoPublicKey", nil, rsa.PSSSaltLengthAuto, 0, errUnsupportedRSAOptions},
+	} {
+		t.Run(c.name, func(t *testing.T) {
+			got, err := pssSaltLength(c.pub, c.saltLength, hLen)
+			if c.wantErr != nil {
+				require.ErrorIs(t, err, c.wantErr)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, c.want, got)
+		})
+	}
 }
 
 // TestMaxPSSSaltLength checks that rsa.PSSSaltLengthAuto resolves to the same