Skip to main content

4. The NSEC3PARAM Resource Record

4. The NSEC3PARAM Resource Record​

The NSEC3PARAM RR contains the NSEC3 parameters (hash algorithm, flags, iterations, and salt) needed by authoritative servers to calculate hashed owner names. The presence of an NSEC3PARAM RR at a zone apex indicates that the specified parameters may be used by authoritative servers to choose an appropriate set of NSEC3 RRs for negative responses. The NSEC3PARAM RR is not used by validators or resolvers.

If an NSEC3PARAM RR is present at the apex of a zone with a Flags field value of zero, then there MUST be an NSEC3 RR using the same hash algorithm, iterations, and salt parameters present at every hashed owner name in the zone. That is, the zone MUST contain a complete set of NSEC3 RRs with the same hash algorithm, iterations, and salt parameters.

The owner name for the NSEC3PARAM RR is the name of the zone apex.

The type value for the NSEC3PARAM RR is 51.

The NSEC3PARAM RR RDATA format is class independent and is described below.

The class MUST be the same as the NSEC3 RRs to which this RR refers.

4.1. RDATA Fields​

The RDATA for this RR mirrors the first four fields in the NSEC3 RR.

4.1.1. Hash Algorithm​

The Hash Algorithm field identifies the cryptographic hash algorithm used to construct the hash-value.

The acceptable values are the same as the corresponding field in the NSEC3 RR.

4.1.2. Flag Fields​

The Opt-Out flag is not used and is set to zero.

All other flags are reserved for future use, and must be zero.

NSEC3PARAM RRs with a Flags field value other than zero MUST be ignored.

4.1.3. Iterations​

The Iterations field defines the number of additional times the hash is performed.

Its acceptable values are the same as the corresponding field in the NSEC3 RR.

4.1.4. Salt Length​

The Salt Length field defines the length of the salt in octets, ranging in value from 0 to 255.

4.1.5. Salt​

The Salt field is appended to the original owner name before hashing.

4.2. NSEC3PARAM RDATA Wire Format​

The RDATA of the NSEC3PARAM RR is as shown below:

                        1 1 1 1 1 1 1 1 1 1 2 2 2 2 2 2 2 2 2 2 3 3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |   Hash Alg.   |     Flags     |          Iterations           |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |  Salt Length  |                     Salt                      /
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

Hash Algorithm is a single octet.

Flags field is a single octet.

Iterations is represented as a 16-bit unsigned integer, with the most significant bit first.

Salt Length is represented as an unsigned octet. Salt Length represents the length of the following Salt field in octets. If the value is zero, the Salt field is omitted.

Salt, if present, is encoded as a sequence of binary octets. The length of this field is determined by the preceding Salt Length field.

4.3. Presentation Format​

The presentation format of the RDATA portion is as follows:

  • The Hash Algorithm field is represented as an unsigned decimal

integer. The value has a maximum of 255.

  • The Flags field is represented as an unsigned decimal integer.

The value has a maximum value of 255.

  • The Iterations field is represented as an unsigned decimal

integer. The value is between 0 and 65535, inclusive.

  • The Salt Length field is not represented.

  • The Salt field is represented as a sequence of case-insensitive

hexadecimal digits. Whitespace is not allowed within the sequence. This field is represented as "-" (without the quotes) when the Salt Length field is zero.

Last updated on