diff -Naur mozilla-without-sign//security/nss/cmd/certutil/certutil.c mozilla/security/nss/cmd/certutil/certutil.c
--- security/nss/cmd/certutil/certutil.c	2011-03-28 16:57:45.044018728 +0200
+++ security/nss/cmd/certutil/certutil.c	2011-03-28 16:58:04.346907089 +0200
@@ -236,7 +236,7 @@
         SECOidTag hashAlgTag, CERTName *subject, char *phone, int ascii, 
 	const char *emailAddrs, const char *dnsNames,
         certutilExtnList extnList,
-        PRFileDesc *outFile)
+        PRFileDesc *outFile, CK_RSA_PKCS_PSS_PARAMS *ck_pss)
 {
     CERTSubjectPublicKeyInfo *spki;
     CERTCertificateRequest *cr;
@@ -293,14 +293,30 @@
     }
 
     /* Sign the request */
-    signAlgTag = SEC_GetSignatureAlgorithmOidTag(keyType, hashAlgTag);
+
+    if (ck_pss != NULL) {
+	if ((keyType != rsaKey) && (keyType != rsaPssKey)) {
+	    PORT_FreeArena (arena, PR_FALSE);
+	    SECU_PrintError(progName, "PSS only supported with RSA");
+	    return SECFailure;
+	}
+	signAlgTag = SEC_OID_PKCS1_RSA_PSS_SIGNATURE;
+    } else {
+	signAlgTag = SEC_GetSignatureAlgorithmOidTag(keyType, hashAlgTag);
+    }
+
+/*	
+    ck_psshashAlg = CKM_SHA256;
+    ck_pssmgf = CKG_MGF1_SHA512;
+    ck_psssLen = 20;*/
+
     if (signAlgTag == SEC_OID_UNKNOWN) {
 	PORT_FreeArena (arena, PR_FALSE);
 	SECU_PrintError(progName, "unknown Key or Hash type");
 	return SECFailure;
     }
-    rv = SEC_DerSignData(arena, &result, encoding->data, encoding->len, 
-			 privk, signAlgTag);
+    rv = SEC_DerSignDataWithParams(arena, &result, encoding->data, encoding->len, 
+			 privk, signAlgTag, ck_pss);
     if (rv) {
 	PORT_FreeArena (arena, PR_FALSE);
 	SECU_PrintError(progName, "signing of data failed");
@@ -1001,7 +1017,7 @@
         "\t\t [-1 | --keyUsage [keyUsageKeyword,..]] [-2] [-3] [-4]\n"
         "\t\t [-5 | --nsCertType [nsCertTypeKeyword,...]]\n"
         "\t\t [-6 | --extKeyUsage [extKeyUsageKeyword,...]] [-7 emailAddrs]\n"
-        "\t\t [-8 dns-names] [-a]\n",
+        "\t\t [-8 dns-names] [-a] [--pss params]\n",
 	progName);
     FPS "\t%s -D -n cert-name [-d certdir] [-P dbprefix]\n", progName);
     FPS "\t%s -E -n cert-name -t trustargs [-d certdir] [-P dbprefix] [-a] [-i input]\n", 
@@ -1038,6 +1054,9 @@
     FPS "\t%s -R -s subj -o cert-request-file [-d certdir] [-P dbprefix] [-p phone] [-a]\n"
 	"\t\t [-7 emailAddrs] [-k key-type-or-id] [-h token-name] [-f pwfile] [-g key-size]\n",
 	progName);
+    FPS "\t%s -R -s subj -o cert-request-file [-d certdir] [-P dbprefix]\n"
+        "\t\t [-p phone] [-a] [-7 emailAddrs] [-k key-type-or-id]\n"
+        "\t\t [-h token-name] [-f pwfile] [-g key-size] [--pss params]\n", progName);
     FPS "\t%s -V -n cert-name -u usage [-b time] [-e] [-a]\n"
 	"\t\t[-X] [-d certdir] [-P dbprefix]\n",
 	progName);
@@ -1050,7 +1069,7 @@
         "\t\t [-p phone] [-1] [-2] [-3] [-4] [-5] [-6] [-7 emailAddrs]\n"
         "\t\t [-8 DNS-names]\n"
         "\t\t [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA]\n"
-        "\t\t [--extSKID]\n", progName);
+        "\t\t [--extSKID] [--pss params]\n", progName);
     FPS "\t%s -U [-X] [-d certdir] [-P dbprefix]\n", progName);
     exit(1);
 }
@@ -1736,7 +1755,8 @@
 static SECItem *
 SignCert(CERTCertDBHandle *handle, CERTCertificate *cert, PRBool selfsign, 
          SECOidTag hashAlgTag,
-         SECKEYPrivateKey *privKey, char *issuerNickName, void *pwarg)
+         SECKEYPrivateKey *privKey, char *issuerNickName, void *pwarg,
+         CK_RSA_PKCS_PSS_PARAMS *ck_pss)
 {
     SECItem der;
     SECItem *result = NULL;
@@ -1764,7 +1784,12 @@
 	
     arena = cert->arena;
 
-    algID = SEC_GetSignatureAlgorithmOidTag(privKey->keyType, hashAlgTag);
+    if (ck_pss) {
+	algID = SEC_OID_PKCS1_RSA_PSS_SIGNATURE;
+    } else {
+	algID = SEC_GetSignatureAlgorithmOidTag(privKey->keyType, hashAlgTag);
+	
+    }
     if (algID == SEC_OID_UNKNOWN) {
 	fprintf(stderr, "Unknown key or hash type for issuer.");
 	goto done;
@@ -1776,6 +1801,10 @@
 	goto done;
     }
 
+    if (ck_pss) {
+	PSSU_EncodeDERPSSParams(&cert->signature.parameters, ck_pss);
+    }
+
     /* we only deal with cert v3 here */
     *(cert->version.data) = 2;
     cert->version.len = 1;
@@ -1795,7 +1824,8 @@
 	goto done;
     }
 
-    rv = SEC_DerSignData(arena, result, der.data, der.len, privKey, algID);
+    rv = SEC_DerSignDataWithParams(arena, result, der.data, der.len, privKey,
+				   algID, ck_pss);
     if (rv != SECSuccess) {
 	fprintf (stderr, "Could not sign encoded certificate data.\n");
 	/* result allocated out of the arena, it will be freed
@@ -1828,7 +1858,8 @@
 	const char *dnsNames,
 	PRBool  ascii,
 	PRBool  selfsign,
-	certutilExtnList extnList)
+	certutilExtnList extnList,
+	CK_RSA_PKCS_PSS_PARAMS *ck_pss)
 {
     void *	extHandle;
     SECItem *	certDER;
@@ -1890,7 +1921,7 @@
 	}
 
 	certDER = SignCert(handle, subjectCert, selfsign, hashAlgTag,
-	                   *selfsignprivkey, issuerNickName,pwarg);
+	                   *selfsignprivkey, issuerNickName,pwarg, ck_pss);
 
 	if (certDER) {
 	   if (ascii) {
@@ -2090,7 +2121,8 @@
     opt_SourcePrefix,
     opt_UpgradeID,
     opt_UpgradeTokenName,
-    opt_Help
+    opt_Pss,
+    opt_Help,
 };
 
 static const
@@ -2190,6 +2222,8 @@
                                                    "upgrade-id"},
 	{ /* opt_UpgradeTokenName    */  0,   PR_TRUE,  0, PR_FALSE, 
                                                    "upgrade-token-name"},
+	{ /* opt_Pss                 */  0,   PR_TRUE,  0, PR_FALSE, 
+                                                   "pss"},
 };
 #define NUM_OPTIONS ((sizeof options_init)  / (sizeof options_init[0]))
 
@@ -2237,6 +2271,9 @@
     secuPWData  pwdata2         = { PW_NONE, 0 };
     PRBool      readOnly        = PR_FALSE;
     PRBool      initialized     = PR_FALSE;
+    CK_RSA_PKCS_PSS_PARAMS *ck_pss = NULL;
+    char *      tempparam;
+    SECOidTag   hashMaskAlgTag;
 
     SECKEYPrivateKey *privkey = NULL;
     SECKEYPublicKey *pubkey = NULL;
@@ -2338,6 +2375,50 @@
 	}
     }
 
+    /*  PSS Parameters */
+    if (certutil.options[opt_Pss].activated) {
+	ck_pss = PORT_Alloc(sizeof(ck_pss));
+	if (hashAlgTag == SEC_OID_UNKNOWN) {
+	    ck_pss->hashAlg = CKM_SHA_1;
+	} else {
+	    ck_pss->hashAlg = PK11_AlgtagToMechanism(hashAlgTag);
+	}
+	/* if pss is set to default, use hash from -Z for both */
+	/* hash and maskhash alg, use mgf1, set salt to max. */
+	/* value depending on hash length */
+	if (PL_strcmp(certutil.options[opt_Pss].arg, "default") == NULL) {
+	    ck_pss->mgf = PK11_MgfMap(SEC_OID_PKCS1_MGF1, hashAlgTag);
+	    /* this could be replaced with an autodetection for max */
+	    /* salt length */
+	    ck_pss->sLen = 20;
+	} else {
+	    tempparam = strtok(certutil.options[opt_Pss].arg, ":");
+	    if (PL_strcmp(tempparam, "MGF1") != 0) {
+		PR_fprintf(PR_STDERR, "%s -pss: only MGF1 supported\n",
+			   progName);
+		return 255;
+	    }
+	    tempparam = strtok(NULL, ":");
+	    if (tempparam == NULL)
+		PR_fprintf(PR_STDERR, "%s --pss: use [mgf]:[hash]:[slen]\n",
+			   progName);
+	    hashMaskAlgTag = SECU_StringToSignatureAlgTag(tempparam);
+	    if (hashMaskAlgTag == SEC_OID_UNKNOWN) {
+		PR_fprintf(PR_STDERR, "%s -pss:  %s is not a recognized hash.\n",
+			   progName, tempparam);
+		return 255;
+	    }
+	    ck_pss->mgf = PK11_MgfMap(SEC_OID_PKCS1_MGF1, hashMaskAlgTag);
+	    tempparam = strtok(NULL, ":");
+	    ck_pss->sLen = atoi(tempparam);
+	    if (strtok(NULL, ":")) {
+		PR_fprintf(PR_STDERR, "%s -pss:  too many arguments.\n",
+			   progName);
+		return 255;
+	    }
+	}
+    }
+
     /*  -k key type  */
     if (certutil.options[opt_KeyType].activated) {
 	char * arg = certutil.options[opt_KeyType].arg;
@@ -3051,7 +3132,8 @@
 		     certutil.options[opt_ExtendedEmailAddrs].arg,
 		     certutil.options[opt_ExtendedDNSNames].arg,
                      certutil_extns,
-                     outFile ? outFile : PR_STDOUT);
+                     outFile ? outFile : PR_STDOUT,
+                     ck_pss);
 	if (rv) 
 	    goto shutdown;
 	privkey->wincx = &pwdata;
@@ -3073,7 +3155,8 @@
 		     NULL,
 		     NULL,
                      nullextnlist,
-                     outFile ? outFile : PR_STDOUT);
+                     outFile ? outFile : PR_STDOUT,
+                     ck_pss);
 	if (rv) 
 	    goto shutdown;
 	privkey->wincx = &pwdata;
@@ -3107,7 +3190,8 @@
 		        certutil.options[opt_ExtendedDNSNames].arg,
 	                certutil.options[opt_ASCIIForIO].activated,
 	                certutil.options[opt_SelfSign].activated,
-	                certutil_extns);
+	                certutil_extns,
+	                ck_pss);
 	if (rv) 
 	    goto shutdown;
     }
diff -Naur mozilla-without-sign//security/nss/lib/cryptohi/cryptohi.h mozilla/security/nss/lib/cryptohi/cryptohi.h
--- security/nss/lib/cryptohi/cryptohi.h	2011-03-28 16:57:45.235017624 +0200
+++ security/nss/lib/cryptohi/cryptohi.h	2011-03-28 16:57:52.892973334 +0200
@@ -399,6 +399,20 @@
 extern SECStatus
 PSSU_DecodeDERPSSParams(CK_RSA_PKCS_PSS_PARAMS *dest, SECOidTag *hashAlg,
 	       const SECItem *in);
+extern SECStatus
+PSSU_EncodeDERPSSParams(SECItem *dest, CK_RSA_PKCS_PSS_PARAMS *in);
+
+extern SECStatus
+SEC_DerSignDataWithParams(PLArenaPool *arena, SECItem *result,
+			  unsigned char *buf, int len, SECKEYPrivateKey *pk,
+			  SECOidTag algID, void* params);
+
+extern SECStatus
+SEC_SignDataWithParams(SECItem *res, const unsigned char *buf, int len,
+		       SECKEYPrivateKey *pk, SECOidTag algid, void *params);
+
+extern SGNContext *
+SGN_NewContextWithParams(SECOidTag alg, SECKEYPrivateKey *key, void *params);
 
 SEC_END_PROTOS
 
diff -Naur mozilla-without-sign//security/nss/lib/cryptohi/pssutil.c mozilla/security/nss/lib/cryptohi/pssutil.c
--- security/nss/lib/cryptohi/pssutil.c	2011-03-28 16:57:45.236017619 +0200
+++ security/nss/lib/cryptohi/pssutil.c	2011-03-28 16:57:52.892973334 +0200
@@ -143,3 +143,69 @@
 
     return rv;
 }
+
+SECStatus
+PSSU_EncodeDERPSSParams(SECItem *dest, CK_RSA_PKCS_PSS_PARAMS *in)
+{
+    SECKEYRSAPSSParams *pss_params;
+    PRArenaPool *arena;
+    SECItem *ret;
+    unsigned int i;
+    SECOidTag hashAlg, maskAlg, maskHashAlg;
+    SECStatus rv;
+    SECItem *params;
+    SECAlgorithmID algId;
+
+    hashAlg = PK11_MechanismToAlgtag(in->hashAlg);
+
+    if (in->mgf == CKG_MGF1_SHA1) {
+	maskAlg = SEC_OID_PKCS1_MGF1;
+	maskHashAlg = SEC_OID_SHA1;
+    } else if (in->mgf == CKG_MGF1_SHA256) {
+	maskAlg = SEC_OID_PKCS1_MGF1;
+	maskHashAlg = SEC_OID_SHA256;
+    } else if (in->mgf == CKG_MGF1_SHA384) {
+	maskAlg = SEC_OID_PKCS1_MGF1;
+	maskHashAlg = SEC_OID_SHA384;
+    } else if (in->mgf == CKG_MGF1_SHA512) {
+	maskAlg = SEC_OID_PKCS1_MGF1;
+	maskHashAlg = SEC_OID_SHA512;
+    } else {
+	PORT_SetError(SEC_ERROR_INVALID_ARGS);
+	return SECFailure;
+    }
+
+    arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
+    pss_params = PORT_ArenaZNew(arena, SECKEYRSAPSSParams);
+
+    if (hashAlg != SEC_OID_SHA1) {
+	pss_params->hashAlg = PORT_ArenaZAlloc(arena, sizeof(SECAlgorithmID));
+	SECOID_SetAlgorithmID(arena, pss_params->hashAlg, hashAlg, NULL);
+    }
+
+    if (maskHashAlg != SEC_OID_SHA1) {
+	pss_params->maskAlg = PORT_ArenaZAlloc(arena, sizeof(SECAlgorithmID));
+	bzero(&algId, sizeof(SECAlgorithmID));
+	SECOID_SetAlgorithmID(arena, &algId, maskHashAlg, NULL);
+	params = SEC_ASN1EncodeItem(arena, NULL, &algId,
+				    SEC_ASN1_GET(SECOID_AlgorithmIDTemplate));
+	SECOID_SetAlgorithmID(arena, pss_params->maskAlg, maskAlg, params);
+    }
+
+    if (in->sLen != 20) {
+	DER_SetUInteger(arena, &pss_params->saltLength, in->sLen);
+    }
+
+    /* no non-standard trailerFields supported, see RFC 3447, A.2.3 */
+    pss_params->trailerField.data = NULL;
+    ret = SEC_ASN1EncodeItem(arena, NULL, pss_params,
+			     SECKEY_RSAPSSParamsTemplate);
+
+    dest->len=ret->len;
+    dest->data=PORT_Alloc(dest->len);
+    PORT_Memcpy(dest->data, ret->data, ret->len);
+
+    PORT_FreeArena(arena, PR_FALSE);
+
+    return SECSuccess;
+}
diff -Naur mozilla-without-sign//security/nss/lib/cryptohi/secsign.c mozilla/security/nss/lib/cryptohi/secsign.c
--- security/nss/lib/cryptohi/secsign.c	2011-03-28 16:57:45.235017624 +0200
+++ security/nss/lib/cryptohi/secsign.c	2011-03-28 16:57:52.892973334 +0200
@@ -56,15 +56,23 @@
     void *hashcx;
     const SECHashObject *hashobj;
     SECKEYPrivateKey *key;
+    void *params;
 };
 
 SGNContext *
 SGN_NewContext(SECOidTag alg, SECKEYPrivateKey *key)
 {
+    return SGN_NewContextWithParams(alg, key, NULL);
+}
+
+SGNContext *
+SGN_NewContextWithParams(SECOidTag alg, SECKEYPrivateKey *key, void *params)
+{
     SGNContext *cx;
     SECOidTag hashalg, signalg;
     KeyType keyType;
     SECStatus rv;
+    CK_RSA_PKCS_PSS_PARAMS *ck_pss;
 
     /* OK, map a PKCS #7 hash and encrypt algorithm into
      * a standard hashing algorithm. Why did we pass in the whole
@@ -79,12 +87,22 @@
 	PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
 	return 0;
     }
+    if (alg == SEC_OID_PKCS1_RSA_PSS_SIGNATURE) {
+	if (params != NULL) {
+	    ck_pss = params;
+	    hashalg = PK11_MechanismToAlgtag(ck_pss->hashAlg);
+	} else {
+	    hashalg = SEC_OID_SHA1;
+	}
+    }
+
     keyType = seckey_GetKeyType(signalg);
 
     /* verify our key type */
     if (key->keyType != keyType &&
 	!((key->keyType == dsaKey) && (keyType == fortezzaKey)) &&
-	!((key->keyType == fortezzaKey) && (keyType == dsaKey)) ) {
+	!((key->keyType == fortezzaKey) && (keyType == dsaKey)) &&
+	!((key->keyType == rsaKey) && (keyType == rsaPssKey))) {
 	PORT_SetError(SEC_ERROR_INVALID_ALGORITHM);
 	return 0;
     }
@@ -101,6 +119,7 @@
 	cx->hashalg = hashalg;
 	cx->signalg = signalg;
 	cx->key = key;
+	cx->params = params;
     }
     return cx;
 }
@@ -198,8 +217,7 @@
     }
     (*cx->hashobj->end)(cx->hashcx, digest, &part1, sizeof(digest));
 
-
-    if (privKey->keyType == rsaKey) {
+    if ((privKey->keyType == rsaKey) && (cx->signalg!=SEC_OID_PKCS1_RSA_PSS_SIGNATURE)) {
 
 	arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
 	if ( !arena ) {
@@ -243,7 +261,12 @@
 	goto loser;
     }
 
-    rv = PK11_Sign(privKey, &sigitem, &digder);
+    if (cx->signalg == SEC_OID_PKCS1_RSA_PSS_SIGNATURE)
+	rv = PK11_SignWithSigAlg(privKey, &sigitem, &digder,
+				 SEC_OID_PKCS1_RSA_PSS_SIGNATURE, cx->params,
+				 sizeof(CK_RSA_PKCS_PSS_PARAMS));
+    else
+	rv = PK11_Sign(privKey, &sigitem, &digder);
     if (rv != SECSuccess) {
 	PORT_Free(sigitem.data);
 	sigitem.data = NULL;
@@ -280,11 +303,18 @@
 SEC_SignData(SECItem *res, const unsigned char *buf, int len,
 	     SECKEYPrivateKey *pk, SECOidTag algid)
 {
+    return SEC_SignDataWithParams(res, buf, len, pk, algid, NULL);
+}
+
+SECStatus
+SEC_SignDataWithParams(SECItem *res, const unsigned char *buf, int len,
+	     SECKEYPrivateKey *pk, SECOidTag algid, void *params)
+{
     SECStatus rv;
     SGNContext *sgn;
 
 
-    sgn = SGN_NewContext(algid, pk);
+    sgn = SGN_NewContextWithParams(algid, pk, params);
 
     if (sgn == NULL)
 	return SECFailure;
@@ -344,9 +374,20 @@
 	const unsigned char *buf, int len, SECKEYPrivateKey *pk,
 	SECOidTag algID)
 {
+    return SEC_DerSignDataWithParams(arena, result, buf, len, pk, algID, NULL);
+}
+
+
+SECStatus
+SEC_DerSignDataWithParams(PRArenaPool *arena, SECItem *result, 
+	unsigned char *buf, int len, SECKEYPrivateKey *pk, SECOidTag algID,
+	void* params)
+{
     SECItem it;
     CERTSignedData sd;
     SECStatus rv;
+    SECItem* derparam;
+    CK_RSA_PKCS_PSS_PARAMS *ck_pss;
 
     it.data = 0;
 
@@ -372,7 +413,7 @@
     }
 
     /* Sign input buffer */
-    rv = SEC_SignData(&it, buf, len, pk, algID);
+    rv = SEC_SignDataWithParams(&it, buf, len, pk, algID, params);
     if (rv) goto loser;
 
     /* Fill out SignedData object */
@@ -382,12 +423,21 @@
     sd.signature.data = it.data;
     sd.signature.len = it.len << 3;		/* convert to bit string */
     rv = SECOID_SetAlgorithmID(arena, &sd.signatureAlgorithm, algID, 0);
+
+    if (algID == SEC_OID_PKCS1_RSA_PSS_SIGNATURE) {
+	PSSU_EncodeDERPSSParams(&sd.signatureAlgorithm.parameters, params);
+    }
+
     if (rv) goto loser;
 
     /* DER encode the signed data object */
     rv = DER_Encode(arena, result, CERTSignedDataTemplate, &sd);
     /* FALL THROUGH */
 
+    if (algID == SEC_OID_PKCS1_RSA_PSS_SIGNATURE) {
+	SECITEM_FreeItem(&sd.signatureAlgorithm.parameters, PR_FALSE);
+    }
+
   loser:
     PORT_Free(it.data);
     return rv;
diff -Naur mozilla-without-sign//security/nss/lib/nss/nss.def mozilla/security/nss/lib/nss/nss.def
--- security/nss/lib/nss/nss.def	2011-03-28 16:57:45.240017596 +0200
+++ security/nss/lib/nss/nss.def	2011-03-28 16:57:52.892973334 +0200
@@ -1018,6 +1018,10 @@
 ;;SECKEY_RSAPSSParamsTemplate DATA ;
 NSS_Get_SECKEY_RSAPSSParamsTemplate;
 PK11_MgfMap;
+PSSU_DecodeDERPSSParams;
+PSSU_EncodeDERPSSParams;
+SEC_DerSignDataWithParams;
+SEC_SignDataWithParams;
 ;+    local:
 ;+       *;
 ;+};
diff -Naur mozilla-without-sign//security/nss/lib/pk11wrap/pk11obj.c mozilla/security/nss/lib/pk11wrap/pk11obj.c
--- security/nss/lib/pk11wrap/pk11obj.c	2011-03-28 16:57:45.321017128 +0200
+++ security/nss/lib/pk11wrap/pk11obj.c	2011-03-28 16:57:52.893973329 +0200
@@ -759,6 +759,17 @@
 SECStatus
 PK11_Sign(SECKEYPrivateKey *key, SECItem *sig, SECItem *hash)
 {
+    return PK11_SignWithSigAlg(key, sig, hash, SEC_OID_UNKNOWN, NULL, 0);
+}
+
+/*
+ * sign a hash. The algorithm is determined by the key.
+ */
+SECStatus
+PK11_SignWithSigAlg(SECKEYPrivateKey *key, SECItem *sig, SECItem *hash,
+		  SECOidTag sigAlg, void *sigParams,
+		  unsigned int sigParamsLen)
+{
     PK11SlotInfo *slot = key->pkcs11Slot;
     CK_MECHANISM mech = {0, NULL, 0 };
     PRBool owner = PR_TRUE;
@@ -766,7 +777,13 @@
     CK_ULONG len;
     CK_RV crv;
 
-    mech.mechanism = PK11_MapSignKeyType(key->keyType);
+    if (sigAlg != SEC_OID_UNKNOWN) {
+	mech.mechanism = PK11_AlgtagToMechanism(sigAlg);
+    } else {
+	mech.mechanism = PK11_MapSignKeyType(key->keyType);
+    }
+    mech.pParameter = sigParams;
+    mech.ulParameterLen = sigParamsLen;
 
     if (SECKEY_HAS_ATTRIBUTE_SET(key,CKA_PRIVATE)) {
 	PK11_HandlePasswordCheck(slot, key->wincx);
diff -Naur mozilla-without-sign//security/nss/lib/pk11wrap/pk11pub.h mozilla/security/nss/lib/pk11wrap/pk11pub.h
--- security/nss/lib/pk11wrap/pk11pub.h	2011-03-28 16:57:45.322017122 +0200
+++ security/nss/lib/pk11wrap/pk11pub.h	2011-03-28 16:57:52.893973329 +0200
@@ -682,6 +682,9 @@
 int PK11_SignatureLen(SECKEYPrivateKey *key);
 PK11SlotInfo * PK11_GetSlotFromPrivateKey(SECKEYPrivateKey *key);
 SECStatus PK11_Sign(SECKEYPrivateKey *key, SECItem *sig, SECItem *hash);
+SECStatus PK11_SignWithSigAlg(SECKEYPrivateKey *key, SECItem *sig,
+			      SECItem *hash, SECOidTag sigAlg,
+			      void *sigParams, unsigned int sigParamsLen);
 SECStatus PK11_VerifyRecover(SECKEYPublicKey *key, SECItem *sig,
 						 SECItem *dsig, void * wincx);
 SECStatus PK11_Verify(SECKEYPublicKey *key, SECItem *sig, 
