Subject: NSEC3 Issue 16: The need for a Hash Length Field.

From: Roy Arends <[email-masked]>
Date: Wed, 31 May 2006 12:23:25 +0200

Issue:

The length of a hash is dependend on the hash function used. SHA1 produces 
160 bit values, while SHA256 produces 256 bit values.  Currently, the 
NSEC3 rdata lacks a hash length field, which makes the length of the Next 
Hashed Ownername field dependend on the hash algorithm listed in the Hash 
Algorithm field. However, when the hash algorithm is unknown, the length 
of the Next Hashed Ownername field is unknown. It is then impossible to 
express the NSEC3 record in proper presentation format.

Discussion:

There are cases where the presentation format of the NSEC3 RR is needed. 
Since the Next Hashed Ownername field is followed by the Type Bit Maps, 
the length of the Next Hashed Ownername field is needed to determine where 
the Type Bit Maps start. 

Possible approaches:

1) present the NSEC3 as an unknown type (rfc 3597). 

Eventhough this is technically viable, it is not an optimal solution. The 
presentation format is typically useful for debugging. The rdata format 
specified in rfc 3597 is useless for debugging. Besides, this is not 
really an unknown type.

2) extracting he lenght of the hash value from the owner name. 

The owner name consists of a hash value (in base32 format), followed by 
the name of the zone. Hence, the hash length (in bits) is typically 5 
times the length of the first label (in octets). Eventhough this is 
technically viable as well, it is clumsy.

3) add a hash length field to the rdata format. 

This is a straightforward way to determine the hash length, for the cost 
of one octet per NSEC3 value. 

Resoltion:

The authors decided to add a hash length field to the NSEC3 rdata format 
(approach 3). The hash length field expresses the length of the hash field 
in octets. The authors consider this issue closed.

Regards,

Roy 

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>