NSEC3HASH(8)

📦 version 9.16.50, in centos-stream 9

💅 NSEC3HASH(8) 💅

ok so bestie, welcome to nsec3hash — part of the BIND 9 lineup, and literally the glow-up you need for your NSEC3 math. no cap, she's a tiny little tool but she works. ✨

🎀 NAME 🎀

nsec3hash — generate NSEC3 hash. that's it, that's the whole vibe. 👑

✨ SYNOPSIS ✨

nsec3hash {salt} {algorithm} {iterations} {domain}

nsec3hash -r {algorithm} {flags} {iterations} {salt} {domain}

two whole modes, bestie. pick your fighter. 🦋

🌸 DESCRIPTION 🌸

so like, nsec3hash generates an NSEC3 hash based on a set of NSEC3 parameters. that's the whole job. and honestly? she ate. 💅

why do you care? because you can use this to check the validity of NSEC3 records in a signed zone — which is lowkey the entire point. if your hash doesn't match, something is deeply wrong and you should probably sit down. 😭

okay and then there's the plot twist: if this command is invoked as nsec3hash -r, it takes arguments in order, matching the first four fields of an NSEC3 record followed by the domain name: algorithm, flags, iterations, salt, domain. so the order is different from the normal mode — don't mix them up, i'm begging you 🙈.

the whole reason -r exists is convenience: you can literally copy and paste a portion of an NSEC3 or NSEC3PARAM record straight into a command line to confirm the correctness of an NSEC3 hash. chef's kiss. no retyping, no suffering, no 3am debugging session. 🔥

🌈 ARGUMENTS 🌈

  • salt — this is the salt provided to the hash algorithm. yes, like actual seasoning for your hash. iconic. 🧂
  • algorithm — this is a number indicating the hash algorithm. currently the only supported hash algorithm for NSEC3 is SHA-1, which is indicated by the number 1. consequently, "1" is the only useful value for this argument. so like... type 1. that's the whole decision tree. 💀
  • flags — this is provided for compatibility with NSEC3 record presentation format, but is ignored, since the flags do not affect the hash. she's there for the aesthetic only. main character energy, zero impact. ✨
  • iterations — this is the number of additional times the hash should be performed. yes additional. as in on top of the first one. don't ask me why, it's in the spec, just pass the number 🫶
  • domain — this is the domain name to be hashed. the actual star of the show. give her a name and let her cook. 👑

🦋 SEE ALSO 🦋

  • BIND 9 Administrator Reference Manual — the big book, your new bedtime reading 📖
  • RFC 5155 — the sacred text where all of this is written down ⭐

💖 AUTHOR 💖

Internet Systems Consortium — the legends themselves 🫶

2024, Internet Systems Consortium. protective, as they should be. 💜

and that's the page bestie! brought to you by BIND 9 version 9.16.50-RH, dated 2024, straight from the Internet Systems Consortium themselves. go forth and hash responsibly. mwah. 💋🎀

📦 where this page comes from