Deprecation notice for NSEC3 salt

[Matthijs Mekking]

On 10/8/26 15:43, Matthijs Mekking via bind-users wrote:
> Hi,
> 
> You are right, I meant "nsec3param salt-length".
> 
> On 10/8/26 11:34, pgnd wrote:
>>> Thus, I am notifying you that we intend to end support for the "nsec3 
>>> salt-length" (inside dnssec-policy) option in named. Our plan is to 
>>> mark them as deprecated in BIND 9.20, and remove them completely as 
>>> of BIND 9.22.
>>
>> @ https://bind9.readthedocs.io/en/latest/dnssec-guide.html#advanced- 
>> discussions-nsec3-salt
>>
>> there's no reference to a literal "nsec3 salt-length"
>>
>> rather, usage in policy of "nsec3param ..."
>>
>>    nsec3param iterations 0 optout no salt-length 0;
>>
>> just to confirm, the removal will then require
>>
>> -  nsec3param iterations 0 optout no salt-length 0;
>> +  nsec3param iterations 0 optout no;
>>
>> ?
> 
> Yes,
> 
>> with the salt-length hardwired == 0?
> 
> And yes.


And since the only iterations value that is allowed is 0, I think we can 
remove that too.