
we shouldn't reject digest lengths larger than SHA256: the FIPS algorithm tests include SHA384 and SHA512 tests.
The stuff in here is based on patches supplied to me by Steven Schoch <schoch@sheba.arc.nasa.gov> to do DSS. I have since modified a them a little but a debt of gratitude is due for doing the initial work.