title: Verifying NSEC3 records
body: <p>I'm fiddling with DNSSEC, and I'd like to try to verify NSEC3 records generated by <code>dnssec-signzone</code> from <code>bind9-utils</code> (which I presume are valid). This is my zone file:</p>
  <pre><code>$ORIGIN dnssectest.mvolfik.tk.
  $TTL 120
  @   SOA dnssectestns.mvolfik.tk. email.example.com. 15 259200 3600 300000 3600
      A   192.168.0.101
  s3c A   192.168.0.101
  
  $INCLUDE zsk.key
  $INCLUDE ksk.key
  </code></pre>
  <p>ZSK and KSK are generated with <code>dnssec-keygen -a ECDSAP256SHA256 dnssectest.mvolfik.tk.</code> (add <code>-f KSK</code> respectively)</p>
  <p>I then signed it using the command <code>dnssec-signzone -3 deadbeef -H 5 -o dnssectest.mvolfik.tk -k ksk.key zonefile zsk.key</code> (use NSEC3 with <code>deadbeef</code> hex salt, 5 iterations)</p>
  <p>I got the following NSEC3 records in the <code>zonefile.signed</code>: (omitted RRSIG and DNSKEY as irrelevant; A and SOA didn't change)</p>
  <pre><code>            0   NSEC3PARAM 1 0 5 DEADBEEF
  F66KKS17FM851AVA4EARFHS55I3TOO85.dnssectest.mvolfik.tk. 3600 IN NSEC3 1 0 5 DEADBEEF (
                      D60TA5J5RS4JD5AQK25B1BCUAHGP4DHC
                      A SOA RRSIG DNSKEY NSEC3PARAM )
  D60TA5J5RS4JD5AQK25B1BCUAHGP4DHC.dnssectest.mvolfik.tk. 3600 IN NSEC3 1 0 5 DEADBEEF (
                      F66KKS17FM851AVA4EARFHS55I3TOO85
                      A RRSIG )
  </code></pre>
  <p>Now that I know that the only domains in this zone are <code>s3c.dnssectest.mvolfik.tk.</code> and <code>dnssectest.mvolfik.tk.</code>, I assume that the following Python script would get me the same hashes as in the signe zone file above: (from pseudocode in <a href="https://www.rfc-editor.org/rfc/rfc5155#section-5" rel="nofollow noreferrer">RFC 5155</a>)</p>
  <pre class="lang-py prettyprint-override"><code>import hashlib
  def ih(salt, x, k):
      if k == 0:
          return hashlib.sha1(x + salt).digest()
      return hashlib.sha1(ih(salt, x, k-1) + salt).digest()
  
  print(ih(bytes.fromhex(&quot;deadbeef&quot;), b&quot;s3c.dnssectest.mvolfik.tk.&quot;, 5).hex())
  
  print(ih(bytes.fromhex(&quot;deadbeef&quot;), b&quot;dnssectest.mvolfik.tk.&quot;, 5).hex())
  </code></pre>
  <p>However, I instead got <code>b58374998347ba833ab33f15332829a589a80d82</code> and <code>545e01397a776ee73aa0372aea015408cc384574</code>. What am I doing wrong?</p>