DNS signature verification (for BIND 9.2.3)

[nishant]

Hi,

I have just started using the BIND 9.2.3 code and am trying to
understand how DNSSEC works. I have the following queries and request
you to help me out.

I have read that:
when a query is issued with DNSSEC option enabled, the response
obtained is found to have a SIG record and a KEY record. These records
are used to authenticate the sender by decrypting the SIG record.

The query is:
how is this done? and,
Where in code can i find the encryption and decryption being done for
the same?

Any help will be appreciated.

Thanks,
Nishant.