How do I verify a root DNS trust anchor?

Question

I am trying to verify root Key Signing Key (KSK) against the trust anchor (Kjqmt7v.crt) downloaded from here. I am getting root KSK using the Net::DNS module.

I am very confused at present on how to verify that both are the same. I tried to convert the .crt file to a Keyset object, but it is resulting in an error.

This is my code.

#!/usr/bin/perl
use strict;
use warnings; 
use Net::DNS::Keyset;
my $keyset = Net::DNS::Keyset->new('Kjqmt7v.crt');
$keyset->print;

This is the error

 We expected a match RDATA
0��0���0   *�H��  0K10 U 
this Should not happen
 at a.pl line 5

I am very confused and therefore unable to provide any proper code, as I have no idea how to start. Pointing me in the right direction would be very helpful.

I want a way to verify trust anchor against the KSK that I am getting from root DNS servers. If there is any other way to do that please update me.

You should start by [edit]ing your question to include the code that you wrote _to convert crt file to a Keyset object_ and the error it showed. — simbabque, Apr 08 '16 at 13:38
@simbabque I have edited my question. Please update if anything more is required. — shivams, Apr 08 '16 at 14:58

score 1 · Accepted Answer · answered Apr 09 '16 at 06:34

You seem to have misunderstood what's in the files IANA provides. None of them except the public root key itself is actually DNSSEC data. The Kjqmt7v.crt file, for example, is an X.509 certificate in DER format (so it's no wonder that Net::DNS::Keyset chokes on it). If you look at it (with the openssl x509 command, for example), you can see that included in its DN field is the textual representation of a DS record for the root KSK. So if you verify that certificate, you know that DS is genuine, and you can use that to verify the DNSKEY.

Another alternative available at the same URL, which is probably easier to use for most people, is a DS for the KSK in XML format, with a detached PGP signature. Verify the signature, use the data in the XML file to build a proper DS record in your favorite programming language, and then you can use that to verify the KSK DNSKEY record.

I created DS from KSK DNSKEY record and then match DS->digest to digest present in XML file. Is this way ok? — shivams, Apr 09 '16 at 06:40
You should really check the digest type and algorithm too, but basically yes. — Calle Dybedahl, Apr 10 '16 at 06:49

How do I verify a root DNS trust anchor?

1 Answers1