Subject: NSEC3 Issue 18: signalling complete NSEC3 chains

From: Roy Arends <[email-masked]>
Date: Wed, 31 May 2006 15:11:21 +0200

ISSUE:

A server must use NSEC3 records from a complete chain. How does it know 
what parameters (salt, iterations, algorithm) to use that belong to a 
complete chain.

discussion:

A hash algorithm, salt and iterations value define a hash name space. 
There may be multiple hash name spaces due to different hash algorithms, 
salts and iterations values.  There must be at least one hash name space 
with a complete circular chain of NSEC3 records. More than one chain of 
NSEC3 records may be complete.

In order for an authoritative server to be able to find proper NSEC3 RRs, 
it MUST choose a single hash name space to use when selecting NSEC3s for a 
response. How does it determine the hash name space that is complete?

Resolution:

In the absence of any other metadata, the server does this by using the 
hash name space defined by the zone apex NSEC3, recognizable by the 
presence of the SOA bit in the type bit map. If there is more than one 
NSEC3 record that has the SOA bit in the type bit map, then the server may 
arbitrarily choose one. 

An NSEC3 with the SOA bit in the type bit map MUST be part of a complete 
chain of NSEC3s. Conversely, if there exists an incomplete chain of NSEC3 
RRs within a hash name space, there MUST NOT be an NSEC3 RR with the SOA 
bit set for this hash name space.

When adding or deleting NSEC3 records, the NSEC3 record with the SOA type 
bit set is the last one to be added to make the chain complete for that 
hash name space, and the first NSEC3 to be removed if the chain is to be 
removed from the zone.

This language currently exists in the draft in section 5.2 and appendix 
C.1 (special considerations, salting). The authors will fold the appendix 
and section into a new section under 5.
The authors consider this issue closed.

Regards,

Roy

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>