# What salt should be used when generating TLS 1.3 CertificateVerify message?

When signing handshake messages digest, the MGF1 function takes some salt value with same length as the digest has. But what content must be in salt's buffer?

I explored the source code of libnettle, especially method rsa_pss_sha256_verify_digest and found that salt which is used inside is 32 similar bytes - 0x22. Using this value I was able to generate a valid signature myself. But I found no information about the salt in any documentation. How is it actually generated for TLS 1.3 CertificateVerify message? Is this value fixed or depends on certificate or key...?

Choosing a non-random (or too short) salt for PSS can reveal the message, since it makes the message guessable from the signature. This is not a concern for a TLS handshake since the message itself contains a random input (ClientHello.random and ServerHello.random).