Consider the following dig
command and its truncated output:
dig . dnskey +dnssec +multi @a.root-servers.net
...
...
;; ANSWER SECTION:
. 172800 IN DNSKEY 257 3 8 (
AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTO
iW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN
7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5
LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8
efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7
pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLY
A4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws
9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU=
) ; KSK; alg = RSASHA256 ; key id = 20326
The ICANN website lists multiple different hashes in the root-anchors.xml
file and the two PDFs with physical signatures.
I attempted to run sha256sum
directly on base64-decoding of the above DNSKEY record and got d6b602bc8f107abe8e9b68c2d0afbfe1ca655767063b1d20c31a6398f3521d2e
, which does not match any of the hashes as far as I can tell.
What set of commands can I run on output of the dig command to get or verify any or all of the hashes listed on the ICANN website?