Deterministically Encoded CBOR (D-CBOR)

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.¶

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.¶

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."¶

This Internet-Draft will expire on 15 February 2024.¶

Copyright Notice

Copyright (c) 2023 IETF Trust and the persons identified as the document authors. All rights reserved.¶

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document.¶

Table of Contents

1. Introduction

This specification introduces a deterministic encoding scheme for data expressed in the CBOR [RFC8949] format. This scheme is subsequently referred to as D‑CBOR.¶

Note that this document is not on the IETF standards track. However, a conformant implementation is supposed to adhere to the specified behavior for security and interoperability reasons.¶

2. Specification

The deterministic encoding scheme used by D‑CBOR builds on Section 4.2 of [RFC8949]. However, to achieve a fixed and bidirectional representation of numbers, Rule 2 in Section 4.2.2 MUST also be adhered to. Also see Appendix A.¶

Occurrences of unknown or malformed CBOR data itmes MUST be rejected.¶

For applications that depend on reencoding of CBOR data items, compliant decoder implementations MUST be able to recreate such data in its original form. This means for example that the string component of date items (tag 0) MUST be kept "as is" in order to maintain deterministic reencoding.¶

The optional numerical extensions described in Section 3.4.4. of [RFC8949] MUST be treated as distinct data items as well as not be subjected to any transformations at the encoding level.¶

A compliant D‑CBOR implementation SHOULD as a minimum support the following CBOR data items:¶

See also Appendix B.¶

3. IANA Considerations

This document has no IANA actions.¶

4. Security Considerations

This specification inherits all the security considerations of CBOR [RFC8949].¶

Applications that exploit the uniqueness of deterministic encoding should verify that the used decoder actually flags incorrectly formatted CBOR data items.¶

Appendix A. Encoding of Numbers

This section is normative.¶

The following sub sections hold examples of numbers expressed in diagnostic notation (Section 8 of [RFC8949]) and their hexadecimal counterparts when using D‑CBOR encoding.¶

Note that the values and encodings are supposed to work in both directions.¶

Appendix B. Implementation Constraints

This section is informative.¶

Note that even if an application does not support (or need) bignum or floating point data items, you can still use D-CBOR since a strict subset is upwardly compatible with full-blown implementations. Low-end platforms typically also restrict CBOR map keys to integer and text string data items. Since these issues are application specific, they are out of scope for this specification.¶

Appendix C. Reference Implementations

This section is informative.¶

Reference implementations that conform to this specification include:¶

• JavaScript: <https://github.com/cyberphone/CBOR.js#cborjs>¶
• JDK 17+: <https://github.com/cyberphone/openkeystore#cbor-support>¶
• Android/Java: <https://github.com/cyberphone/android-cbor#cbor-for-android>¶

Appendix D. Online Tools

This section is informative.¶

The following online tools enable testing D‑CBOR without installing any software:¶

• <https://cyberphone.github.io/CBOR.js/doc/playground.html>¶
• <https://test.webpki.org/csf-lab/convert>¶

Acknowledgements

TBD¶

Document History

[[ This section to be removed by the RFC Editor before publication as an RFC ]]¶

Version 00:¶

• Initial publication.¶

Version 01:¶

• Added Table 1: Supported CBOR Data Types¶

Version 02:¶

• Added bidirectional + reencoding to 2¶

Version 03:¶

• Added ref to 3.4.4. Decimal Fractions and Bigfloats.¶
• Type => Data Item (throughout the spec).¶

Version 04-00:¶

• Document name spelling error.¶

Version 01:¶

• Minor tweaks.¶

Version 02:¶

• ISE submission and associated changes.¶

Version 03:¶

• Number table clarifications.¶

Author's Address