Internet DRAFT - draft-rundgren-deterministc-cbor
draft-rundgren-deterministc-cbor
CBOR A. Rundgren, Ed.
Internet-Draft Independent
Intended status: Informational 8 August 2023
Expires: 9 February 2024
Deterministically Encoded CBOR (D-CBOR)
draft-rundgren-deterministc-cbor-03
Abstract
This document describes a deterministic encoding scheme for CBOR
intended for usage in high-end computing platforms like mobile
phones, Web browsers, and Web servers. In addition to enhancing
interoperability, deterministic encoding can also support
cryptographic operations like signing CBOR data items. Using this
specification, the latter can achieved without wrapping such data in
byte strings or depend on non-standard canonicalization procedures.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 9 February 2024.
Copyright Notice
Copyright (c) 2023 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document.
Rundgren Expires 9 February 2024 [Page 1]
Internet-Draft D-CBOR August 2023
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Objectives . . . . . . . . . . . . . . . . . . . . . . . 2
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
2. Specification . . . . . . . . . . . . . . . . . . . . . . . . 3
3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 4
4. Security Considerations . . . . . . . . . . . . . . . . . . . 4
5. References . . . . . . . . . . . . . . . . . . . . . . . . . 4
5.1. Normative References . . . . . . . . . . . . . . . . . . 4
5.2. Informative References . . . . . . . . . . . . . . . . . 5
Appendix A. Encoding of Numbers . . . . . . . . . . . . . . . . 5
A.1. Integer Numbers . . . . . . . . . . . . . . . . . . . . . 5
A.2. Floating Point Numbers . . . . . . . . . . . . . . . . . 6
A.2.1. Dedicated Floating Point Numbers . . . . . . . . . . 6
A.2.2. Assorted Floating Point Numbers . . . . . . . . . . . 7
Appendix B. Implementation Constraints . . . . . . . . . . . . . 8
Appendix C. Reference Implementations . . . . . . . . . . . . . 9
Appendix D. Online Tools . . . . . . . . . . . . . . . . . . . . 9
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 9
Document History . . . . . . . . . . . . . . . . . . . . . . . . 9
Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 10
1. Introduction
This specification introduces a deterministic encoding scheme for
data expressed in the CBOR [RFC8949] format. This scheme is
subsequently referred to as D-CBOR.
1.1. Objectives
The primary objective of D-CBOR is providing an interoperable CBOR
profile for high-end computing platforms like mobile phones, Web
browsers, and Web servers. However, D-CBOR also enables performing
digital signatures over "raw" (unwrapped) CBOR data items since
signatures depend on a _unified_ representation of the data to be
signed. In addition, D-CBOR permits decoded CBOR data to be
subjected to simple and secure transformation and reencoding
operations.
The deterministic encoding scheme described in this document is
characterized by being bidirectional also when CBOR is provided in
_diagnostic notation_ (Section 8 of [RFC8949]), making D-CBOR
comparatively easy to understand, debug, and implement.
See also [I-D.mcnally-deterministic-cbor] which represents an
alternative approach to deterministic encoding.
Rundgren Expires 9 February 2024 [Page 2]
Internet-Draft D-CBOR August 2023
1.2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
2. Specification
The deterministic encoding scheme used by D-CBOR builds on
Section 4.2 of [RFC8949]. However, to achieve a _fixed and
bidirectional_ representation of numbers, Rule 2 in Section 4.2.2
MUST also be adhered to. Also see Appendix A.
Occurrences of CBOR data items that do not conform to this
specification MUST be flagged as an error.
For applications that depend on _reencoding_ of CBOR data items,
compliant decoder implementations MUST be able to recreate such data
in its original form. This means for example that the string
component of date items (tag 0) MUST be kept "as is" in order to
maintain deterministic reencoding.
The _optional_ numerical extensions described in Section 3.4.4. of
[RFC8949] MUST be treated as _distinct_ data items as well as not be
subjected to any transformations at the encoding level.
A compliant D-CBOR implementation SHOULD support the following CBOR
data items:
Rundgren Expires 9 February 2024 [Page 3]
Internet-Draft D-CBOR August 2023
+================+=====================+
| Data Item | Tag |
+================+=====================+
| integer | Major type 0 and 1 |
+----------------+---------------------+
| bignum | 0xc2 and 0xc3 |
+----------------+---------------------+
| floating point | 0xf9, 0xfa and 0xfb |
+----------------+---------------------+
| byte string | Major type 2 |
+----------------+---------------------+
| text string | Major type 3 |
+----------------+---------------------+
| false | 0xf4 |
+----------------+---------------------+
| true | 0xf5 |
+----------------+---------------------+
| null | 0xf6 |
+----------------+---------------------+
| array | Major type 4 |
+----------------+---------------------+
| map | Major type 5 |
+----------------+---------------------+
| tag | Major type 6 |
+----------------+---------------------+
Table 1: Supported CBOR Data Items
CBOR data items that do not match Table 1 MUST be rejected.
See also Appendix B.
3. IANA Considerations
This document has no IANA actions.
4. Security Considerations
This specification inherits all the security considerations of CBOR
[RFC8949].
Applications that exploit the uniqueness of deterministic encoding
should verify that the used decoder actually flags incorrectly
formatted CBOR data items.
5. References
5.1. Normative References
Rundgren Expires 9 February 2024 [Page 4]
Internet-Draft D-CBOR August 2023
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119,
DOI 10.17487/RFC2119, March 1997,
<https://www.rfc-editor.org/info/rfc2119>.
[RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
May 2017, <https://www.rfc-editor.org/info/rfc8174>.
[RFC8949] Bormann, C. and P. Hoffman, "Concise Binary Object
Representation (CBOR)", STD 94, RFC 8949,
DOI 10.17487/RFC8949, December 2020,
<https://www.rfc-editor.org/info/rfc8949>.
5.2. Informative References
[I-D.mcnally-deterministic-cbor]
McNally, W. and C. Allen, "Gordian dCBOR: Deterministic
CBOR Implementation Practices", Work in Progress,
Internet-Draft, draft-mcnally-deterministic-cbor-01, 4 May
2023, <https://datatracker.ietf.org/doc/html/draft-
mcnally-deterministic-cbor-01>.
Appendix A. Encoding of Numbers
This section is normative.
The following sub sections hold examples of numbers and their
encoding using D-CBOR.
Note that the values and encodings are supposed to work in both
directions.
A.1. Integer Numbers
The following table holds a set of integers highlighting the
selection between integer and bignum data items.
Rundgren Expires 9 February 2024 [Page 5]
Internet-Draft D-CBOR August 2023
+=======================+========================+
| Value | Encoding |
+=======================+========================+
| 0 | 00 |
+-----------------------+------------------------+
| -1 | 20 |
+-----------------------+------------------------+
| 23 | 17 |
+-----------------------+------------------------+
| 24 | 1818 |
+-----------------------+------------------------+
| -24 | 37 |
+-----------------------+------------------------+
| -25 | 3818 |
+-----------------------+------------------------+
| 255 | 18ff |
+-----------------------+------------------------+
| 256 | 190100 |
+-----------------------+------------------------+
| -256 | 38ff |
+-----------------------+------------------------+
| -257 | 390100 |
+-----------------------+------------------------+
| 65535 | 19ffff |
+-----------------------+------------------------+
| 65536 | 1a00010000 |
+-----------------------+------------------------+
| 1099511627775 | 1b000000ffffffffff |
+-----------------------+------------------------+
| 18446744073709551615 | 1bffffffffffffffff |
+-----------------------+------------------------+
| 18446744073709551616 | c249010000000000000000 |
+-----------------------+------------------------+
| -18446744073709551616 | 3bffffffffffffffff |
+-----------------------+------------------------+
| -18446744073709551617 | c349010000000000000000 |
+-----------------------+------------------------+
Table 2: Integer Numbers
A.2. Floating Point Numbers
A.2.1. Dedicated Floating Point Numbers
The following table holds the set of dedicated IEEE 754 values. Note
that NaN "signaling" MUST be flagged as an error.
Rundgren Expires 9 February 2024 [Page 6]
Internet-Draft D-CBOR August 2023
+===========+==========+
| Value | Encoding |
+===========+==========+
| 0.0 | f90000 |
+-----------+----------+
| -0.0 | f98000 |
+-----------+----------+
| Infinity | f97c00 |
+-----------+----------+
| -Infinity | f9fc00 |
+-----------+----------+
| NaN | f97e00 |
+-----------+----------+
Table 3: Dedicated
Floating Point Numbers
A.2.2. Assorted Floating Point Numbers
The following table holds a set of "ordinary" IEEE 754 values
including some edge cases. Note that subnormal floating point values
MUST be supported.
Rundgren Expires 9 February 2024 [Page 7]
Internet-Draft D-CBOR August 2023
+==========================+====================+
| Value | Encoding |
+==========================+====================+
| -5.960464477539062e-8 | fbbe6fffffffffffff |
+--------------------------+--------------------+
| -5.9604644775390625e-8 | f98001 |
+--------------------------+--------------------+
| -5.960464477539064e-8 | fbbe70000000000001 |
+--------------------------+--------------------+
| -5.960465188081798e-8 | fab3800001 |
+--------------------------+--------------------+
| 0.00006097555160522461 | f903ff |
+--------------------------+--------------------+
| 65504.0 | f97bff |
+--------------------------+--------------------+
| 65504.00390625 | fa477fe001 |
+--------------------------+--------------------+
| 65536.0 | fa47800000 |
+--------------------------+--------------------+
| 10.559998512268066 | fa4128f5c1 |
+--------------------------+--------------------+
| 10.559998512268068 | fb40251eb820000001 |
+--------------------------+--------------------+
| 3.4028234663852886e+38 | fa7f7fffff |
+--------------------------+--------------------+
| 3.402823466385289e+38 | fb47efffffe0000001 |
+--------------------------+--------------------+
| 1.401298464324817e-45 | fa00000001 |
+--------------------------+--------------------+
| 1.1754942106924411e-38 | fa007fffff |
+--------------------------+--------------------+
| 5.0e-324 | fb0000000000000001 |
+--------------------------+--------------------+
| -1.7976931348623157e+308 | fbffefffffffffffff |
+--------------------------+--------------------+
Table 4: Assorted Floating Point Numbers
Appendix B. Implementation Constraints
This section is informative.
Note that even if an application does not support (or need) bignum or
floating point data items, you can still use D-CBOR since a strict
subset is upwardly compatible with full-blown implementations. Low-
end platforms typically also restrict CBOR map keys to integer and
text string data items. Since these issues are application specific,
they are out of scope for this specification.
Rundgren Expires 9 February 2024 [Page 8]
Internet-Draft D-CBOR August 2023
Appendix C. Reference Implementations
This section is informative.
Reference implementations that conform to this specification include:
* JavaScript: <https://github.com/cyberphone/CBOR.js#cborjs>
* JDK 17+: <https://github.com/cyberphone/openkeystore#cbor-support>
* Android/Java: <https://github.com/cyberphone/android-cbor#cbor-
for-android>
Appendix D. Online Tools
This section is informative.
The following online tools enable testing D-CBOR without installing
any software:
* <https://cyberphone.github.io/CBOR.js/doc/playground.html>
* <https://test.webpki.org/csf-lab/convert>
Acknowledgements
TBD
Document History
[[ This section to be removed by the RFC Editor before publication as
an RFC ]]
Version 00:
* Initial publication.
Version 01:
* Added Table 1: Supported CBOR Data Types
Version 02:
* Added bidirectional + reencoding to 2
Version 03:
* Added ref to 3.4.4. Decimal Fractions and Bigfloats.
Rundgren Expires 9 February 2024 [Page 9]
Internet-Draft D-CBOR August 2023
* Type => Data Item (throughout the spec).
Author's Address
Anders Rundgren (editor)
Independent
Montpellier
France
Email: anders.rundgren.net@gmail.com
URI: https://www.linkedin.com/in/andersrundgren/
Rundgren Expires 9 February 2024 [Page 10]
