Verifying report integrity

Each daily report in the reports repository is sealed with an RFC 3161 timestamp issued by CNX's own Timestamp Authority (TSA), and the KSK attestation included in it carries its own cryptographic signature. Both can be verified independently of CNX.

Verifying the KSK attestation

latest/ksk-attestation.json includes a signature proving CNX's protected key-management system held the private key behind your current KSK at report time:

jq -r '.zones["example.com."].ksk_pubkey_pem'            latest/ksk-attestation.json > pubkey.pem
jq -r '.zones["example.com."].attestation_challenge'     latest/ksk-attestation.json > challenge.txt
jq -r '.zones["example.com."].attestation_signature_b64' latest/ksk-attestation.json | base64 -d > sig.der

openssl dgst -sha256 -verify pubkey.pem -signature sig.der challenge.txt
# Expected output: Verified OK

For end-to-end comparison, the ksk_key_tag in the same file should correspond to the DNSKEY served in that day's 03-serving-state.txt and the DS record published at the parent in 04-parent-ds.txt — see Reports repository format.

Verifying the daily timestamp

Each day's attestation/YYYY/MM/DD/manifest.txt records the SHA-256 hash of every report file for that day; manifest.tsr is an RFC 3161 timestamp token over that manifest.

# Inspect the timestamp token
openssl ts -reply -in attestation/2026/08/26/manifest.tsr -text

# Fetch the CNX TSA CA certificate
curl -fsS -o cnx_ica_tsa.crt https://crl.cnx.net.kh/cnx_ica_tsa.crt

# Verify the timestamp token against the manifest
openssl ts -verify \
  -in attestation/2026/08/26/manifest.tsr \
  -data attestation/2026/08/26/manifest.txt \
  -CAfile cnx_ica_tsa.crt
# Expected output: Verification: OK

# Verify the report files against the timestamped manifest
sha256sum -c attestation/2026/08/26/manifest.txt
# Expected output: one "OK" line per file

Together, these confirm that the mirrored copy your team retains matches what CNX timestamped that day, and hasn't been altered since. General RFC 3161 validation instructions and the CNX TSA trust chain are published at https://tsa.cnx.net.kh/validation.html.