Class Dnsruby::RR::NSEC3
In: lib/Dnsruby/resource/NSEC3.rb
Parent: RR

The NSEC3 Resource Record (RR) provides authenticated denial of existence for DNS Resource Record Sets.

The NSEC3 RR lists RR types present at the original owner name of the NSEC3 RR. It includes the next hashed owner name in the hash order of the zone. The complete set of NSEC3 RRs in a zone indicates which RRSets exist for the original owner name of the RR and form a chain of hashed owner names in the zone. This information is used to provide authenticated denial of existence for DNS data. To provide protection against zone enumeration, the owner names used in the NSEC3 RR are cryptographic hashes of the original owner name prepended as a single label to the name of the zone. The NSEC3 RR indicates which hash function is used to construct the hash, which salt is used, and how many iterations of the hash function are performed over the original owner name.

Methods

Constants

TypeValue = Types::NSEC3 #:nodoc: all
OPT_OUT = 1

Attributes

flags  [R]  The Flags field contains 8 one-bit flags that can be used to indicate different processing. All undefined flags must be zero. The only flag defined by the NSEC3 specification is the Opt-Out flag.
hash_alg  [R]  The Hash Algorithm field identifies the cryptographic hash algorithm used to construct the hash-value.
hash_length  [R]  The Hash Length field defines the length of the Next Hashed Owner Name field, ranging in value from 1 to 255 octets.
iterations  [RW]  The Iterations field defines the number of additional times the hash function has been performed.
next_hashed  [RW]  The Next Hashed Owner Name field contains the next hashed owner name in hash order.
salt_length  [R]  The Salt Length field defines the length of the Salt field in octets, ranging in value from 0 to 255.
types  [R]  The Type Bit Maps field identifies the RRset types that exist at the NSEC RR‘s owner name

Public Class methods

Public Instance methods

def salt_length=(l)

  if ((l < 0) || (l > 255))
    raise DecodeError.new("NSEC3 salt length must be between 0 and 255")
  end
  @salt_length = l

end

If the Opt-Out flag is set, the NSEC3 record covers zero or more unsigned delegations.

The Salt field is appended to the original owner name before hashing in order to defend against pre-calculated dictionary attacks.

[Validate]