Objective: Get DNSSEC root KSK (key-signing keys) keys.
DNSSEC works by digitally signing records for DNS lookup using public-key cryptography. The correct DNSKEY record is authenticated via a chain of trust, starting with a set of verified public keys for the DNS root zone which is the trusted third party. Domain owners generate their own keys, and upload them using their DNS control panel at their domain registrar, which in turn pushes the keys to the zone operator who signs and publishes them in DNS.
The DNSSEC keys for DNS root are published and are publicly available, but you can also get it using the dig utility. You will just need to get the DNSKEY records from DNS root and filter for KSK (id is 257). Zone signing key (ZSK) has an id of 256.
|
1 2 3 |
$ dig . dnskey | grep -e '^\.' | grep 257 > root_dnssec_key $ cat root_dnssec_key . 2422 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq QxA+Uk1ihz0= |
The key is now in the file named root_dnssec_key. The key is in base64 format and it’s split into small chunks separated by spaces. If you prefer not to split the key, use the +nosplit option.
|
1 2 3 |
$ dig . dnskey +nosplit | grep -e '^\.' | grep 257 > root_dnssec_key_nosplit $ cat root_dnssec_key_nosplit . 2253 IN DNSKEY 257 3 8 AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjFFVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoXbfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaDX6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpzW5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relSQageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulqQxA+Uk1ihz0= |
We can now use the key to verify DNSSEC signature chains for DNSSEC enabled domains using dig. We will need to inform dig that the trusted keys can be found in the key file.
|
1 2 |
$ dig +sigchase +trusted-key=root_dnssec_key www.cloudflare.com | grep -i dnssec ;; Ok this DNSKEY is a Trusted Key, DNSSEC validation is ok: SUCCESS |
Mohamed Ibrahim
ibrahim = { interested_in(unix, linux, android, open_source, reverse_engineering); coding(c, shell, php, python, java, javascript, nodejs, react); plays_on(xbox, ps4); linux_desktop_user(true); }
