1.1.Objectives

The objectives of CBOR, roughly in decreasing order of importance,are:¶

1. The representation must be able to unambiguously encode most commondata formats used in Internet standards.¶

   • It must represent a reasonable set of basic data types andstructures using binary encoding. "Reasonable" here is largelyinfluenced by the capabilities of JSON, with the major additionof binary byte strings. The structures supported are limited toarrays and trees; loops and lattice-style graphs are notsupported.¶
   • There is no requirement that all data formats be uniquelyencoded; that is, it is acceptable that the number "7" might beencoded in multiple different ways.¶

2. The code for an encoder or decoder must be able to be compact inorder to support systems with very limited memory, processor power,and instruction sets.¶

   • An encoder and a decoder need to be implementable in a verysmall amount of code (for example, in class 1 constrained nodesas defined in[RFC7228]).¶
   • The format should use contemporary machine representations ofdata (for example, not requiring binary-to-decimal conversion).¶

3. Data must be able to be decoded without a schema description.¶

   • Similar to JSON, encoded data should be self-describing so thata generic decoder can be written.¶

4. The serialization must be reasonably compact, but data compactnessis secondary to code compactness for the encoder and decoder.¶

   • "Reasonable" here is bounded by JSON as an upper bound in size and by the implementation complexity, which limits the amount of effort that can go into achieving that compactness. Using either general compression schemes or extensive bit-fiddling violates the complexity goals.¶

5. The format must be applicable to both constrained nodes andhigh-volume applications.¶

   • This means it must be reasonably frugal in CPU usage for bothencoding and decoding. This is relevant both for constrainednodes and for potential usage in applications with a very highvolume of data.¶

6. The format must support all JSON data types for conversion to andfrom JSON.¶

   • It must support a reasonable level of conversion as long as thedata represented is within the capabilities of JSON. It must bepossible to define a unidirectional mapping towards JSON for alltypes of data.¶

7. The format must be extensible, and the extended data must bedecodable by earlier decoders.¶

   • The format is designed for decades of use.¶
   • The format must support a form of extensibility that allowsfallback so that a decoder that does not understand an extensioncan still decode the message.¶
   • The format must be able to be extended in the future by laterIETF standards.¶

1.2.Terminology

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14[RFC2119][RFC8174] when, and only when, they appear in all capitals, as shown here.¶

The term "byte" is used in its now-customary sense as a synonym for"octet". All multi-byte values are encoded in network byte order (thatis, most significant byte first, also known as "big-endian").¶

This specification makes use of the following terminology:¶

Data item:

A single piece of CBOR data. The structure of a data item maycontain zero, one, or more nested data items. The term is used bothfor the data item in representation format and for the abstract ideathat can be derived from that by a decoder; the former can beaddressed specifically by using the term "encoded data item".¶

Decoder:

A process that decodes a well-formed encoded CBOR data item and makes it available to anapplication. Formally speaking, a decoder contains a parser tobreak up the input using the syntax rules of CBOR, as well as asemantic processor to prepare the data in a form suitable to theapplication.¶

Encoder:

A process that generates the (well-formed) representation format of a CBOR dataitem from application information.¶

Data Stream:

A sequence of zero or more data items, not further assembled into alarger containing data item (see[RFC8742] for one application).The independent data items that makeup a data stream are sometimes also referred to as "top-level dataitems".¶

Well-formed:

A data item that follows the syntactic structure of CBOR. Awell-formed data item uses the initial bytes and the byte stringsand/or data items that are implied by their values as defined inCBOR and does not include following extraneous data. CBOR decodersby definition only return contents from well-formed data items.¶

Valid:

A data item that is well-formed and also follows the semanticrestrictions that apply to CBOR data items (Section 5.3).¶

Expected:

Besides its normal English meaning, the term "expected" is used todescribe requirements beyond CBOR validity that an application hason its input data. Well-formed (processable at all), valid (checkedby a validity-checking generic decoder), and expected (checked by theapplication) form a hierarchy of layers of acceptability.¶

Stream decoder:

A process that decodes a data stream and makes each of the dataitems in the sequence available to an application as they arereceived.¶

Terms and concepts for floating-point values such as Infinity, NaN(not a number), negative zero, and subnormal are defined in[IEEE754].¶

Where bit arithmetic or data types are explained, this document usesthe notation familiar from the programming language C[C], except that".." denotes a range that includes both ends given, and superscriptnotation denotes exponentiation. For example, 2 to the power of 64 isnotated: 2⁶⁴.In the plain-text version of this specification, superscript notationis not available and therefore is rendered by a surrogate notation.That notation is not optimized for this RFC; it is unfortunatelyambiguous with C's exclusive-or (which is only used in the appendices,which in turn do not use exponentiation) and requires circumspectionfrom the reader of the plain-text version.¶

Examples and pseudocodeassume that signed integers use two's complement representation andthat right shifts of signed integers perform sign extension; theseassumptions are also specified in Sections 6.8.1 (basic.fundamental)and 7.6.7 (expr.shift) of the 2020 version of C++ (currently availableas a final draft,[Cplusplus20]).¶

Similar to the "0x" notation forhexadecimal numbers, numbers in binary notation are prefixed with"0b". Underscores can be added to a number solely forreadability, so 0b00100001 (0x21) might be written 0b001_00001 toemphasize the desired interpretation of the bits in the byte; in thiscase, it is split into three bits and five bits. Encoded CBOR dataitems are sometimes given in the "0x" or "0b" notation; these valuesare first interpreted as numbers as in C and are then interpreted asbyte strings in network byte order, including any leading zero bytesexpressed in the notation.¶

Words may beitalicized for emphasis; in the plain text form of this specification, this is indicated by surrounding words with underscore characters. Verbatim text (e.g., names from a programming language) may be set inmonospace type; in plain text, this is approximated somewhat ambiguously by surrounding the text in double quotes (which also retain their usual meaning).¶

2.1.Extended Generic Data Models

This basic generic data model has been extended in this document by the registrationof a number of simple values and tag numbers, such as:¶

• false,true,null, andundefined (simple values identified by 20..23,Section 3.3)¶
• integer and floating-point values with a larger range and precisionthan the above (tag numbers 2 to 5,Section 3.4)¶
• application data types such as a point in time or date/time string defined in RFC 3339 (tag numbers 1 and 0,Section 3.4)¶

Additional elements of the extended generic data model can be (and havebeen) defined via the IANA registries created for CBOR. Even if suchan extension is unknown to a generic encoder or decoder, data itemsusing that extension can be passed to or from the application byrepresenting them at the application interface within the basicgeneric data model, i.e., as generic simple values orgeneric tags.¶

In other words, the basic generic data model is stable as defined inthis document, while the extended generic data model expands by theregistration of new simple values or tag numbers, but never shrinks.¶

While there is a strong expectation that generic encoders and decoderscan representfalse,true, andnull (undefined is intentionallyomitted) in the form appropriate for their programming environment,the implementation of the data model extensions created by tags is trulyoptional and a matter of implementation quality.¶

2.2.Specific Data Models

The specific data model for a CBOR-based protocol usually takes a subset of theextended generic data model and assigns application semantics to thedata items within this subset and its components. When documenting such specific data models and specifying the types of data items, it is preferable to identify the types by their generic data model names ("negative integer", "array") instead of referring to aspects of their CBOR representation ("major type 1", "major type 4").¶

Specific data models can also specify value equivalency (including values of different types) for the purposes of map keys and encoder freedom. For example, in the generic data model, a valid mapMAY have both0 and0.0 as keys, and an encoderMUST NOT encode0.0 as an integer(major type 0,Section 3.1). However, if a specific data modeldeclares that floating-point and integer representations of integralvalues are equivalent, using both map keys0 and0.0 in a singlemap would be consideredduplicates, even while encoded as different major types, and so invalid; and an encoder could encode integral-valuedfloats as integers or vice versa, perhaps to save encoded bytes.¶

3.1.Major Types

The following lists the major types and the additional information andother bytes associated with the type.¶

Major type 0:

An unsigned integer in the range 0..2⁶⁴-1 inclusive. The value of theencoded item is the argument itself. For example, theinteger 10 is denoted as the one byte 0b000_01010 (major type 0,additional information 10). The integer 500 would be 0b000_11001(major type 0, additional information 25) followed by the two bytes0x01f4, which is 500 in decimal.¶

Major type 1:

A negative integer in the range -2⁶⁴..-1 inclusive. The value ofthe item is -1 minus the argument. For example, the integer-500 would be 0b001_11001 (major type 1, additional information 25)followed by the two bytes 0x01f3, which is 499 in decimal.¶

Major type 2:

A byte string. The number of bytes in the string is equal to theargument. For example, a bytestring whose length is 5 would have an initial byte of 0b010_00101(major type 2, additional information 5 for the length), followed by5 bytes of binary content. A byte string whose length is 500 wouldhave 3 initial bytes of 0b010_11001 (major type 2, additionalinformation 25 to indicate a two-byte length) followed by the twobytes 0x01f4 for a length of 500, followed by 500 bytes of binarycontent.¶

Major type 3:

A text string (Section 2) encoded as UTF-8[RFC3629]. The number of bytes in the string is equal to theargument. A string containing an invalid UTF-8 sequence iswell-formed but invalid (Section 1.2). This type is provided forsystems that need to interpret or display human-readable text, andallows the differentiation between unstructured bytes and text thathas a specified repertoire (that of Unicode) and encoding (UTF-8). In contrast to formatssuch as JSON, the Unicode characters in this type are neverescaped. Thus, a newline character (U+000A) is always represented ina string as the byte 0x0a, and never as the bytes 0x5c6e (thecharacters "\" and "n") nor as 0x5c7530303061 (the characters "\","u", "0", "0", "0", and "a").¶

Major type 4:

An array of data items. In other formats, arrays are also called lists, sequences, ortuples (a "CBOR sequence" is something slightly different, though[RFC8742]).The argument is the number of data items in thearray. Items in anarray do not need to all be of the same type. For example, an arraythat contains 10 items of any type would have an initial byte of0b100_01010 (major type 4, additional information 10 for thelength) followed by the 10 remaining items.¶

Major type 5:

A map of pairs of data items. Maps are also called tables,dictionaries, hashes, or objects (in JSON). A map is comprised ofpairs of data items, each pair consisting of a key that isimmediately followed by a value. The argument is the numberofpairs of data items in the map. Forexample, a map that contains 9 pairs would have an initial byte of0b101_01001 (major type 5, additional information 9 for thenumber of pairs) followed by the 18 remaining items. The first itemis the first key, the second item is the first value, the third itemis the second key, and so on. Because items in a map come in pairs,their total number is always even: a map that contains an oddnumber of items (no value data present after the last key data item) is not well-formed.A map that has duplicate keys may bewell-formed, but it is not valid, and thus it causes indeterminatedecoding; see alsoSection 5.6.¶

Major type 6:

A tagged data item ("tag") whose tag number, an integer in the range0..2⁶⁴-1 inclusive, is the argument andwhose enclosed data item (tag content) is the single encoded data item that follows the head.SeeSection 3.4.¶

Major type 7:

Floating-point numbers and simple values, as well as the "break"stop code. SeeSection 3.3.¶

These eight major types lead to a simple table showing which of the256 possible values for the initial byte of a data item are used(Table 7).¶

In major types 6 and 7, many of the possible values are reserved forfuture specification. SeeSection 9 for more information on thesevalues.¶

Table 1 summarizes the major types defined by CBOR,ignoringSection 3.2 for now. The number N in this table standsfor the argument.¶

3.2.Indefinite Lengths for Some Major Types

Four CBOR items (arrays, maps, byte strings, and text strings) can beencoded with an indefinite length using additional informationvalue 31. This is useful if the encoding of the item needs to beginbefore the number of items inside the array or map, or the totallength of the string, is known. (The ability to start sending a dataitem before all of it is known is oftenreferred to as "streaming" within that data item.)¶

Indefinite-length arrays and maps are dealt with differently thanindefinite-length strings (byte strings and text strings).¶

83        -- Array of length 3   01     -- 1   82     -- Array of length 2      02  -- 2      03  -- 3   82     -- Array of length 2      04  -- 4      05  -- 5

0x9f018202039f0405ffff9F        -- Start indefinite-length array   01     -- 1   82     -- Array of length 2      02  -- 2      03  -- 3   9F     -- Start indefinite-length array      04  -- 4      05  -- 5      FF  -- "break" (inner array)   FF     -- "break" (outer array)

0x9f01820203820405ff9F        -- Start indefinite-length array   01     -- 1   82     -- Array of length 2      02  -- 2      03  -- 3   82     -- Array of length 2      04  -- 4      05  -- 5   FF     -- "break"

0x83018202039f0405ff83        -- Array of length 3   01     -- 1   82     -- Array of length 2      02  -- 2      03  -- 3   9F     -- Start indefinite-length array      04  -- 4      05  -- 5      FF  -- "break"

0x83019f0203ff82040583        -- Array of length 3   01     -- 1   9F     -- Start indefinite-length array      02  -- 2      03  -- 3      FF  -- "break"   82     -- Array of length 2      04  -- 4      05  -- 5

0xbf6346756ef563416d7421ffBF           -- Start indefinite-length map   63        -- First key, UTF-8 string length 3      46756e --   "Fun"   F5        -- First value, true   63        -- Second key, UTF-8 string length 3      416d74 --   "Amt"   21        -- Second value, -2   FF        -- "break"

0b010_11111 0b010_00100 0xaabbccdd 0b010_00011 0xeeff99 0b111_111115F              -- Start indefinite-length byte string   44           -- Byte string of length 4      aabbccdd  -- Bytes content   43           -- Byte string of length 3      eeff99    -- Bytes content   FF           -- "break"

3.3.Floating-Point Numbers and Values with No Content

Major type 7 is for two types of data: floating-point numbers and"simple values" that do not need any content. Each value of the 5-bitadditional information in the initial byte has its own separatemeaning, as defined inTable 3. Like the major types forintegers, items of this major type do not carry content data; all theinformation is in the initial bytes (the head).¶

As with all other major types, the 5-bit value 24 signifies asingle-byte extension: it is followed by an additional byte torepresent the simple value. (To minimize confusion, only the values 32to 255 are used.) This maintains the structure of the initial bytes:as for the other major types, the length of these always depends onthe additional information in the first byte.Table 4 liststhe numeric values assigned and available for simple values.¶

An encoderMUST NOT issue two-byte sequences that start with 0xf8 (major type 7, additional information 24) and continue with a byte less than 0x20 (32 decimal). Such sequences are not well-formed. (This implies that an encoder cannot encodefalse,true,null, orundefined in two-byte sequences and that only the one-byte variants of these are well-formed; more generally speaking, each simple value only has a single representation variant).¶

The 5-bit values of 25, 26, and 27 are for 16-bit, 32-bit, and 64-bitIEEE 754 binary floating-point values[IEEE754]. These floating-point valuesare encoded in the additional bytes of the appropriate size. (SeeAppendix D for some information about 16-bit floating-point numbers.)¶

3.4.Tagging of Items

In CBOR, a data item can be enclosed by a tag to give it someadditional semantics, as uniquely identified by atag number.The tag is major type 6, its argument (Section 3) indicates the tagnumber, and it contains a single enclosed data item, thetag content.(If a tag requires further structure to its content, this structure isprovided by the enclosed data item.)We use the termtag for the entire data item consisting of both atag number and the tag content: the tag content is the data item thatis being tagged.¶

For example, assume that a byte string of length 12 is marked with atag of number 2 to indicate it is an unsignedbignum (Section 3.4.3).The encoded data item would start with a byte 0b110_00010 (major type6, additional information 2 for the tag number) followed by theencoded tag content: 0b010_01100 (major type 2, additional information12 for the length) followed by the 12 bytes of the bignum.¶

In the extended generic data model, a tag number'sdefinition describes the additional semanticsconveyed with the tag number.These semantics may include equivalence of some tagged dataitems with other data items, including some that can berepresented in the basic generic data model. For instance, 0xc24101,a bignum the tag content of which is the byte string with the singlebyte 0x01, is equivalent to an integer 1, which could also be encodedas 0x01, 0x1801, or 0x190001.The tag definition may specify a preferredserialization (Section 4.1) that is recommended for genericencoders; this may prefer basic generic data model representationsover ones that employ a tag.¶

The tag definition usually defines which nested data items arevalid for such tags. Tag definitions may restrict their content to avery specific syntactic structure, as the tags defined in thisdocument do, or they may define their content more semantically. Anexample for the latter is how tags 40 and 1040 accept multiple ways torepresent arrays[RFC8746].¶

As a matter of convention, many tags do not acceptnull orundefinedvalues as tag content; instead, the expectation is that anull orundefined value can be used in place of the entire tag;Section 3.4.2 provides some further considerations for one specific tag about the handling of this convention in application protocols and in mapping to platform types.¶

Decoders do not need to understand tags of every tag number, and tags may be oflittle value in applications where the implementation creating aparticular CBOR data item and the implementation decoding that streamknow the semantic meaning of each item in the data flow. The primarypurpose of tags in this specification is to define common data types such asdates. A secondary purpose is to provide conversion hints when it isforeseen that the CBOR data item needs to be translated into adifferent format, requiring hints about the content of items.Understanding the semantics of tags isoptional for a decoder; it can simply present both the tag number andthe tag content to the application, without interpreting the additionalsemantics of the tag.¶

A tag applies semantics to the data item it encloses.Tags can nest: if tag A encloses tag B, which encloses data item C,tag A applies to the result of applying tag B on data item C.¶

IANA maintains a registry of tag numbers as described inSection 9.2.Table 5 provides a list of tag numbers that were defined in[RFC7049] with definitions inthe rest of this section.(Tag number 35 was also defined in[RFC7049]; a discussion of thistag number follows inSection 3.4.5.3.)Note that many other tag numbers have been defined since the publication of[RFC7049];see the registry described atSection 9.2 for the complete list.¶

Conceptually, tags are interpreted in the generic data model, not at(de-)serialization time. A small number of tags (at this time, tagnumber 25 and tag number 29[IANA.cbor-tags]) have been registered with semantics thatmay require processing at (de-)serialization time: the decoder needs tobe aware of, and the encoder needs to be in control of, the exactsequence in which data items are encoded into the CBOR data item.This means these tags cannot be implemented on top of an arbitrary genericCBOR encoder/decoder (which might not reflect the serialization orderfor entries in a map at the data model level and vice versa); theirimplementation therefore typically needs to be integrated into thegeneric encoder/decoder. The definition of new tags with thisproperty isNOT RECOMMENDED.¶

IANA allocated tag numbers 65535, 4294967295, and18446744073709551615 (binary all-ones in 16-bit, 32-bit, and 64-bit).These can be used as a convenience for implementerswho want a single-integer data structure to indicate either the presence of a specific tag or absence of a tag.That allocation is described inSection 10 of [CBOR-TAGS].These tags are not intended to occur in actual CBOR data items;implementationsMAY flag such an occurrence as an error.¶

Protocols can extend the generic data model (Section 2) with data items representing points in time by using tag numbers 0 and 1, with arbitrarily sized integers by using tag numbers 2 and 3, and with floating-point values of arbitrary size and precision by using tag numbers 4 and 5.¶

C2                        -- Tag 2   49                     -- Byte string of length 9      010000000000000000  -- Bytes content

C4             -- Tag 4   82          -- Array of length 2      21       -- -2      19 6ab3  -- 27315

C5             -- Tag 5   82          -- Array of length 2      20       -- -1      03       -- 3

4.1.Preferred Serialization

For some values at the data model level, CBOR provides multipleserializations.For many applications, it is desirable that an encoder always choosesa preferred serialization (preferred encoding); however, the present specification does notput the burden of enforcing this preference on either the encoder or decoder.¶

Some constrained decoders may be limited in their ability to decode non-preferred serializations: for example, if only integers below 1_000_000_000 (one billion) are expected in an application, the decoder may leave out the code that would be needed to decode 64-bit arguments in integers. An encoder that always uses preferred serialization ("preferred encoder") interoperates with this decoder for the numbers that can occur in this application. Generally speaking, a preferred encoder is more universally interoperable (and also less wasteful) than one that, say, always uses 64-bit integers.¶

Similarly, a constrained encoder may be limited in the variety ofrepresentation variants it supports such that it does notemit preferred serializations ("variant encoder"). For instance, a constrained encoder couldbe designed toalways use the 32-bit variant for an integer that it encodes even if ashort representation is available (assuming that there is no application need for integers that can onlybe represented with the 64-bit variant).A decoder that does not rely on receiving only preferred serializations ("variation-tolerant decoder") can therefore be said to be moreuniversally interoperable (it might very well optimize for the case ofreceiving preferred serializations, though).Full implementations of CBOR decoders are by definitionvariation tolerant; the distinction is only relevant if a constrainedimplementation of a CBOR decoder meets a variant encoder.¶

The preferred serialization always uses the shortest form ofrepresenting the argument (Section 3); it also uses the shortestfloating-point encoding that preserves the value being encoded.¶

The preferred serialization for a floating-point value is the shortestfloating-point encoding that preserves its value, e.g., 0xf94580 forthe number 5.5, and 0xfa45ad9c00 for the number 5555.5. For NaNvalues, a shorter encoding is preferred if zero-padding the shortersignificand towards the right reconstitutes the original NaN value(for many applications, the single NaN encoding 0xf97e00 willsuffice).¶

Definite-length encoding is preferred whenever the length is known atthe time the serialization of the item starts.¶

4.2.Deterministically Encoded CBOR

Some protocols may want encoders to only emit CBOR in a particulardeterministic format; those protocols might also have the decoders checkthat their input is in that deterministic format. Those protocols arefree to define whatthey mean by a "deterministic format" and what encoders and decoders areexpected to do. This section defines a set of restrictions that canserve as the base of such a deterministic format.¶

5.1.CBOR in Streaming Applications

In a streaming application, a data stream may be composed of asequence of CBOR data items concatenated back-to-back. In such anenvironment, the decoder immediately begins decoding a new data itemif data is found after the end of a previous data item.¶

Not all of the bytes making up a data item may be immediatelyavailable to the decoder; some decoders will buffer additional datauntil a complete data item can be presented to the application. Otherdecoders can present partial information about a top-level data itemto an application, such as the nested data items that could already bedecoded, or even parts of a byte string that hasn't completely arrivedyet.Such an application alsoMUST have a matching streaming security mechanism, wherethe desired protection is available for incremental data presented to theapplication.¶

Note that some applications and protocols will not want to useindefinite-length encoding. Using indefinite-length encoding allowsan encoder to not need to marshal all the data for counting, but itrequires a decoder to allocate increasing amounts of memory whilewaiting for the end of the item. This might be fine for someapplications but not others.¶

5.2.Generic Encoders and Decoders

A generic CBOR decoder can decode all well-formed encoded CBOR data items andpresent the data items to an application. SeeAppendix C.(The diagnostic notation,Section 8, may be used topresent well-formed CBOR values to humans.)¶

Generic CBOR encoders provide an application interface that allows theapplication to specify any well-formed value to be encoded as a CBORdata item, including simple values and tags unknown to the encoder.¶

Even though CBOR attempts to minimize these cases, not all well-formedCBOR data is valid: for example, the encoded text string0x62c0aedoes not contain valid UTF-8 (because[RFC3629] requires always using the shortestform) and so is not a valid CBOR item.Also, specific tags maymake semantic constraints that may be violated, for instance, by a bignum tagenclosing another tag or by an instance of tag number 0 containing a bytestring or containing a text string with contents that do not match thedate-time production of[RFC3339]. There isno requirement that generic encoders and decoders make unnaturalchoices for their application interface to enable the processing ofinvalid data. Generic encoders and decoders are expected to forwardsimple values and tags even if their specific codepoints are notregistered at the time the encoder/decoder is written(Section 5.4).¶

5.3.Validity of Items

A well-formed but invalid CBOR data item (Section 1.2) presents a problem withinterpreting the data encoded in it in the CBOR data model. ACBOR-based protocol could be specified in several layers, in which thelower layers don't process the semantics of some of the CBOR data theyforward. These layers can't notice any validity errors in data they don'tprocess andMUST forward that data as-is. The first layer that doesprocess the semantics of an invalid CBOR itemMUST pick one of twochoices:¶

1. Replace the problematic item with an error marker and continue withthe next item, or¶
2. Issue an error and stop processing altogether.¶

A CBOR-based protocolMUST specify which of these options its decoderstake for each kind of invalid item they might encounter.¶

Such problems might occur at the basic validity level of CBOR or inthe context of tags (tag validity).¶

5.4.Validity and Evolution

A decoder with validity checking will expend the effort to reliablydetect data items with validity errors. For example, such adecoder needs to have an API that reports an error (and does notreturn data) for a CBOR data item that contains any of the validityerrors listed in the previous subsection.¶

The set of tags defined in the "Concise Binary Object Representation (CBOR) Tags" registry (Section 9.2), as well as the set of simple values defined in the "Concise Binary Object Representation (CBOR) Simple Values" registry (Section 9.1), can grow at any time beyond the set understood by a generic decoder. A validity-checking decoder can do one of two things when it encounters such a case that it does not recognize:¶

• It can report an error (and not return data).Note that treating this case as an error can cause ossification and isthus not encouraged. This erroris not a validity error, per se. This kind of error is more likelyto be raised by a decoder that would be performing validity checkingif this were a known case.¶
• It can emit the unknown item (type, value, and, for tags, thedecoded tagged data item) to the application calling the decoder,and then give the applicationan indication that the decoder did not recognize that tagnumber or simple value.¶

The latter approach, which is also appropriate for decoders that donot support validity checking, provides forward compatibility withnewly registered tags and simple values without the requirement toupdate the encoder at the same time as the calling application. (Forthis, the decoder's API needs the ability to mark unknownitems so that the calling application can handle them in a mannerappropriate for the program.)¶

Since some of the processing needed for validity checking may have anappreciable cost (in particular with duplicate detection for maps),support of validity checking is not a requirement placed on all CBORdecoders.¶

Some encoders will rely on their applications to provide input data insuch a way that valid CBOR results from the encoder. A genericencoder may also want to provide a validity-checking mode where itreliably limits its output to valid CBOR, independent of whether ornot its application is indeed providing API-conformant data.¶

5.5.Numbers

CBOR-based protocols should take into account that different languageenvironments pose different restrictions on the range and precision ofnumbers that are representable. For example, the basic JavaScript numbersystem treats all numbers as floating-point values, which may result inthe silent loss of precision in decoding integers with more than 53significant bits.Another example is that, since CBOR keeps the sign bit for its integerrepresentation in the major type, it has one bit more for signednumbers of a certain length (e.g., -2⁶⁴..2⁶⁴-1 for 1+8-byteintegers) than the typical platform signed integer representation ofthe same length (-2⁶³..2⁶³-1 for 8-byte int64_t).A protocol that uses numbers should define itsexpectations on the handling of nontrivial numbers in decoders andreceiving applications.¶

A CBOR-based protocol that includes floating-point numbers canrestrict which of the three formats (half-precision, single-precision,and double-precision) are to be supported. For an integer-onlyapplication, a protocol may want to completely exclude the use offloating-point values.¶

A CBOR-based protocol designed for compactness may want to excludespecific integer encodings that are longer than necessary for theapplication, such as to save the need to implement 64-bit integers.There is an expectation that encoders will use the most compactinteger representation that can represent a given value. However, acompact application that does not require deterministic encodingshould accept values that use a longer-than-neededencoding (such as encoding "0" as 0b000_11001 followed by two bytes of0x00) as long as the application can decode an integer of the givensize.Similar considerations apply to floating-point values; decoding bothpreferred serializations and longer-than-needed ones is recommended.¶

CBOR-based protocols for constrained applications that provide achoice between representing a specific number as an integer andas a decimal fraction or bigfloat (such as when the exponent is smalland nonnegative) might express a quality-of-implementation expectationthat the integer representation is used directly.¶

5.6.Specifying Keys for Maps

The encoding and decoding applications need to agree on what types ofkeys are going to be used in maps. In applications that need tointerwork with JSON-based applications, conversion is simplified bylimiting keys to text strings only; otherwise, there has to be a specifiedmapping from the other CBOR types to text strings, and thisoften leads to implementation errors. In applications where keys arenumeric in nature, and numeric ordering of keys is important to theapplication, directly using the numbers for the keys is useful.¶

If multiple types of keys are to be used, consideration should begiven to how these types would be represented in the specificprogramming environments that are to be used. For example, inJavaScript Maps[ECMA262], a key of integer 1 cannot bedistinguished from a key of floating-point 1.0. This means that, if integerkeys are used, the protocol needs to avoid the use offloating-point keys the values of which happen to be integer numbers in the same map.¶

Decoders that deliver data items nested within a CBOR data itemimmediately on decoding them ("streaming decoders") often do not keepthe state that is necessary to ascertain uniqueness of a key in a map.Similarly, an encoder that can start encoding data items before theenclosing data item is completely available ("streaming encoder") maywant to reduce its overhead significantly by relying on its datasource to maintain uniqueness.¶

A CBOR-based protocolMUST define whatto do when a receiving application sees multiple identical keys ina map. The resulting rule in the protocolMUST respect the CBORdata model: it cannot prescribe a specific handling of the entrieswith the identical keys, except that it might have a rule that havingidentical keys in a map indicates a malformed map and that the decoderhas to stop with an error.When processing maps that exhibit entries with duplicate keys, a genericdecoder might do one of the following:¶

• Not accept maps with duplicate keys (that is, enforce validity for maps,see alsoSection 5.4). These generic decoders areuniversally useful. An application may still need to perform itsown duplicate checking based on application rules (for instance, ifthe application equates integers and floating-point values in mapkey positions for specific maps).¶
• Pass all map entries to the application, including ones withduplicate keys. This requires that the application handle (checkagainst) duplicate keys, even if the application rules are identicalto the generic data model rules.¶
• Lose some entries with duplicate keys, e.g., deliver only thefinal (or first) entry out of the entries with the same key. Withsuch a generic decoder, applications may get different results for aspecific key on different runs, and with different generic decoders,which value is returned is based on generic decoderimplementation and the actual order of keys in the map. Inparticular, applications cannot validate key uniqueness on their ownas they do not necessarily see all entries; they may not be able touse such a generic decoder if they need to validate keyuniqueness. These generic decoders can only be used in situationswhere the data source and transfer alwaysprovide valid maps; this is not possible if the data source and transfer can be attacked.¶

Generic decoders need to document which of these three approaches theyimplement.¶

The CBOR data model for maps does not allow ascribing semantics to theorder of the key/value pairs in the map representation. Thus, aCBOR-based protocolMUST NOT specify that changing the key/value pairorder in a map changes the semantics, except to specify that someorders are disallowed, for example, where they would not meet therequirements of a deterministicencoding (Section 4.2).(Any secondary effects of map ordering such as on timing, cache usage,and other potential side channels are not considered part of thesemantics but may be enough reason on their own for a protocol to require adeterministic encoding format.)¶

Applications for constrained devices should consider using small integers as keys if they have maps with a small number of frequently used keys; for instance, a set of 24 or fewer keys can be encoded in a single byte as unsigned integers, up to 48 if negative integers are also used. Less frequently occurring keys can then use integers with longer encodings.¶

5.7.Undefined Values

In some CBOR-based protocols, the simple value (Section 3.3) ofundefined might be used by an encoder as a substitute for a data itemwith an encoding problem, in order to allow the rest of the enclosingdata items to be encoded without harm.¶

6.1.Converting from CBOR to JSON

Most of the types in CBOR have direct analogs in JSON. However, somedo not, and someone implementing a CBOR-to-JSON converter has toconsider what to do in those cases. The following non-normative advicedeals with these by converting them to a single substitute value, suchas a JSON null.¶

• An integer (major type 0 or 1) becomes a JSON number.¶
• A byte string (major type 2) that is not embedded in a tag thatspecifies a proposed encoding is encoded in base64url withoutpadding and becomes a JSON string.¶
• A UTF-8 string (major type 3) becomes a JSON string. Note that JSONrequires escaping certain characters ([RFC8259],Section 7):quotation mark (U+0022), reverse solidus (U+005C), and the "C0control characters" (U+0000 through U+001F). All other charactersare copied unchanged into the JSON UTF-8 string.¶
• An array (major type 4) becomes a JSON array.¶
• A map (major type 5) becomes a JSON object. This is possibledirectly only if all keys are UTF-8 strings. A converter might alsoconvert other keys into UTF-8 strings (such as by convertingintegers into strings containing their decimal representation);however, doing so introduces a danger of key collision.Note also that, if tags on UTF-8 strings are ignored as proposedbelow, this will cause a keycollision if the tags are different but the strings are the same.¶
• False (major type 7, additional information 20) becomes a JSONfalse.¶
• True (major type 7, additional information 21) becomes a JSON true.¶
• Null (major type 7, additional information 22) becomes a JSON null.¶
• A floating-point value (major type 7, additional information 25through 27) becomes a JSON number if it is finite (that is, it canbe represented in a JSON number); if the value is non-finite (NaN,or positive or negative Infinity), it is represented by thesubstitute value.¶
• Any other simple value (major type 7, any additional informationvalue not yet discussed) is represented by the substitute value.¶
• A bignum (major type 6, tag number 2 or 3) is represented by encodingits byte string in base64url without padding and becomes a JSONstring. For tag number 3 (negative bignum), a "~" (ASCII tilde) isinserted before the base-encoded value. (The conversion to a binaryblob instead of a number is to prevent a likely numeric overflow forthe JSON decoder.)¶
• A byte string with an encoding hint (major type 6, tag number 21through 23) is encoded as described by the hint and becomes a JSON string.¶
• For all other tags (major type 6, any other tag number), the tagcontent is represented as a JSON value; the tag number is ignored.¶
• Indefinite-length items are made definite before conversion.¶

A CBOR-to-JSON converter may want to keep to the JSON profile I-JSON[RFC7493], to maximize interoperability and increase confidencethat the JSON output can be processed with predictable results. Forexample, this has implications on the range of integers that can berepresented reliably, as well as on the top-level items that may besupported by older JSON implementations.¶

6.2.Converting from JSON to CBOR

All JSON values, once decoded, directly map into one or more CBORvalues. As with any kind of CBOR generation, decisions have to bemade with respect to number representation. In a suggestedconversion:¶

• JSON numbers without fractional parts (integer numbers) arerepresented as integers (major types 0 and 1, possibly major type 6,tag number 2 and 3), choosing the shortest form; integers longer thanan implementation-defined threshold may instead be represented asfloating-point values. Thedefault range that is represented as integer is-2⁵³+1..2⁵³-1 (fully exploiting the range for exact integersin the binary64 representation often used for decoding JSON[RFC7493]).A CBOR-based protocol, or a generic converter implementation,may choose -2³²..2³²-1 or -2⁶⁴..2⁶⁴-1 (fullyusing the integer ranges available in CBOR with uint32_t oruint64_t, respectively) or even -2³¹..2³¹-1 or-2⁶³..2⁶³-1 (using popular ranges for two's complementsigned integers).(Ifthe JSON was generated from a JavaScript implementation, itsprecision is already limited to 53 bits maximum.)¶
• Numbers with fractional parts are represented as floating-pointvalues, performing the decimal-to-binary conversion based on theprecision provided by IEEE 754 binary64.The mathematical value of the JSON number is converted to binary64using the roundTiesToEven procedure in Section 4.3.1 of[IEEE754].Then, when encoding inCBOR, the preferred serialization uses the shortest floating-pointrepresentation exactly representing this conversion result; forinstance, 1.5 is represented in a 16-bit floating-point value (notall implementations will be capable of efficiently finding theminimum form, though). Instead of using the default binary64precision, there may be an implementation-defined limit to theprecision of the conversion that will affect the precision of therepresented values. Decimal representation should only be used onthe CBOR side if that is specified in a protocol.¶

CBOR has been designed to generally provide a more compact encodingthan JSON. One implementation strategy that might come to mind is toperform a JSON-to-CBOR encoding in place in a single buffer. Thisstrategy would need to carefully consider a number of pathologicalcases, such as that some strings represented with no or very fewescapes and longer (or much longer) than 255 bytes may expand whenencoded as UTF-8 strings in CBOR. Similarly, a few of the binaryfloating-point representations might cause expansion from some shortdecimal representations (1.1, 1e9) in JSON. This may be hard to getright, and any ensuing vulnerabilities may be exploited by anattacker.¶

7.1.Extension Points

In a protocol design, opportunities for evolution are often includedin the form of extension points. For example, there may be acodepoint space that is not fully allocated from the outset, and theprotocol is designed to tolerate and embrace implementations thatstart using more codepoints than initially allocated.¶

Sizing the codepoint space may be difficult because the range requiredmay be hard to predict. Protocol designs should attempt to make thecodepoint space large enough so that it can slowly be filled over theintended lifetime of the protocol.¶

CBOR has three major extension points:¶

the "simple" space (values in major type 7):

Of the 24 efficient(and 224 slightly less efficient) values, only a small number havebeen allocated. Implementations receiving an unknown simple dataitem may easily be able to process it as such, given that the structure ofthe value is indeed simple. The IANA registry inSection 9.1 is the appropriate way to address theextensibility of this codepoint space.¶

the "tag" space (values in major type 6):

The total codepoint spaceis abundant; only a tiny part of it hasbeen allocated. However, not all of these codepoints are equallyefficient: the first 24 only consume a single ("1+0") byte, andhalf of them have already been allocated. The next 232 values onlyconsume two ("1+1") bytes, with nearly a quarter already allocated.These subspaces need some curation to last for a few more decades.Implementations receiving an unknown tag number can choose toprocess just the enclosed tag content or, preferably, toprocess the tag as an unknown tag number wrapping thetag content. The IANA registry inSection 9.2 is the appropriate way toaddress the extensibility of this codepoint space.¶

the "additional information" space:

An implementation receiving anunknown additional information value has no way to continue decoding,so allocating codepoints in this space is a major step beyond justexercising an extension point. There arealso very few codepoints left. See alsoSection 7.2.¶

7.2.Curating the Additional Information Space

The human mind is sometimes drawn to filling in little perceived gapsto make something neat. We expect the remaining gaps in the codepointspace for the additional information values to be an attractor for newideas, just because they are there.¶

The present specification does not manage the additional informationcodepoint space by an IANA registry. Instead, allocations out of thisspace can only be done by updating this specification.¶

For an additional information value of n >= 24, the size of theadditional data typically is 2^n-24 bytes. Therefore, additionalinformation values 28 and 29 should be viewed as candidates for128-bit and 256-bit quantities, in case a need arises to add them tothe protocol. Additional information value 30 is then the onlyadditional information value available for general allocation, andthere should be a very good reason for allocating it before assigningit through an update of the present specification.¶

8.1.Encoding Indicators

Sometimes it is useful to indicate in the diagnostic notation which ofseveral alternative representations were actually used; for example, adata item written >1.5< by a diagnostic decoder might have beenencoded as a half-, single-, or double-precision float.¶

The convention for encoding indicators is that anything starting withan underscore and all following characters that are alphanumeric orunderscore is an encoding indicator, and can be ignored by anyone notinterested in this information. For example,_ or_3.Encoding indicators are alwaysoptional.¶

A single underscore can be written after the opening brace of a map orthe opening bracket of an array to indicate that the data item wasrepresented in indefinite-length format. For example, [_ 1, 2]contains an indicator that an indefinite-length representation wasused to represent the data item [1, 2].¶

An underscore followed by a decimal digit n indicates that thepreceding item (or, for arrays and maps, the item starting with thepreceding bracket or brace) was encoded with an additional informationvalue of 24+n. For example, 1.5_1 is a half-precision floating-pointnumber, while 1.5_3 is encoded as double precision. This encodingindicator is not shown inAppendix A. (Note that the encodingindicator "_" is thus an abbreviation of the full form "_7", which isnot used.)¶

The detailed chunk structure of byte and text strings of indefinitelength can benotated in the form (_ h'0123', h'4567') and (_ "foo", "bar").However, for an indefinite-length string with no chunks inside, (_ )would be ambiguous as to whether a byte string (0x5fff) or a text string(0x7fff) is meant and is therefore not used.The basic forms ''_ and ""_ can be used instead and are reserved forthe case of no chunks only -- not as short forms for the (permitted,but not really useful) encodings with only empty chunks, which need to be notated as (_ ''), (_ ""), etc.,to preserve the chunk structure.¶

9.1.CBOR Simple Values Registry

IANA has created the "Concise Binary Object Representation (CBOR) Simple Values" registry at[IANA.cbor-simple-values]. The initial values are shown inTable 4.¶

New entries in the range 0 to 19 are assigned by Standards Action[RFC8126]. Itis suggested that IANA allocate values startingwith the number 16 in order to reserve the lower numbers forcontiguous blocks (if any).¶

New entries in the range 32 to 255 are assigned by SpecificationRequired.¶

9.2.CBOR Tags Registry

IANA has created the "Concise Binary Object Representation (CBOR)Tags" registry at[IANA.cbor-tags].The tags that were defined in[RFC7049] are described in detail inSection 3.4,and other tags have already been defined since then.¶

New entries in the range 0 to 23 ("1+0") are assigned by Standards Action.New entries in the ranges 24 to 255 ("1+1") and 256 to 32767 (lowerhalf of "1+2") are assigned by SpecificationRequired. New entries in the range 32768 to 18446744073709551615(upper half of "1+2", "1+4", and "1+8") areassigned by First Come First Served. The template for registrationrequests is:¶

• Data item¶
• Semantics (short form)¶

In addition, First Come First Served requests should include:¶

• Point of contact¶
• Description of semantics (URL) -- This description isoptional; the URL can point to something like an Internet-Draft or aweb page.¶

Applicants exercising the First Come First Served range and makinga suggestion for a tag number that is not representable in 32 bits(i.e., larger than 4294967295)should be aware that this could reduce interoperability withimplementations that do not support 64-bit numbers.¶

9.3.Media Types Registry

The Internet media type[RFC6838] ("MIME type") for a single encoded CBOR dataitem is "application/cbor" as defined in the "Media Types" registry[IANA.media-types]:¶

Type name:

application¶

Subtype name:

cbor¶

Required parameters:

n/a¶

Optional parameters:

n/a¶

Encoding considerations:

Binary¶

Security considerations:

SeeSection 10 of RFC 8949.¶

Interoperability considerations:

n/a¶

Published specification:

RFC 8949¶

Applications that use this media type:

Many¶

Additional information:

Magic number(s):

n/a¶

File extension(s):

.cbor¶

Macintosh file type code(s):

n/a¶

Person & email address to contact for further information:

IETF CBOR Working Group (cbor@ietf.org) or IETF Applications and Real-Time Area (art@ietf.org)¶

Intended usage:

COMMON¶

Restrictions on usage:

none¶

Author:

IETF CBOR Working Group (cbor@ietf.org)¶

Change controller:

The IESG (iesg@ietf.org)¶

9.4.CoAP Content-Format Registry

The CoAP Content-Format for CBOR has been registered in the "CoAP Content-Formats" subregistry within the "Constrained RESTful Environments (CoRE) Parameters" registry[IANA.core-parameters]:¶

Media Type:

application/cbor¶

Encoding:

-¶

ID:

60¶

Reference:

RFC 8949¶

9.5.Structured Syntax Suffix Registry

The structured syntax suffix[RFC6838] for media types based on a single encoded CBOR data item is +cbor, which IANA has registered in the "Structured Syntax Suffixes" registry[IANA.structured-suffix]:¶

Name:

Concise Binary Object Representation (CBOR)¶

+suffix:

+cbor¶

References:

RFC 8949¶

Encoding Considerations:

CBOR is a binary format.¶

Interoperability Considerations:

n/a¶

Fragment Identifier Considerations:

The syntax and semantics of fragment identifiers specified for+cborSHOULD be as specified for "application/cbor". (Atpublication of RFC 8949, there is no fragment identificationsyntax defined for "application/cbor".)¶

The syntax and semantics for fragment identifiers for a specific"xxx/yyy+cbor"SHOULD be processed as follows:¶

• For cases defined in +cbor, where the fragment identifier resolvesper the +cbor rules, then process as specified in +cbor.¶
• For cases defined in +cbor, where the fragment identifier doesnot resolve per the +cbor rules, then process as specified in"xxx/yyy+cbor".¶
• For cases not defined in +cbor, then process as specified in"xxx/yyy+cbor".¶

Security Considerations:

SeeSection 10 of RFC 8949.¶

Contact:

IETF CBOR Working Group (cbor@ietf.org) orIETF Applications and Real-Time Area (art@ietf.org)¶

Author/Change Controller:

IETF¶

E.1.ASN.1 DER, BER, and PER

[ASN.1] has many serializations. In the IETF, DER and BER are themost common. The serialized output is not particularly compact formany items, and the code needed to decode numeric items can be complexon a constrained device.¶

Few (if any) IETF protocols have adopted one of the several variantsof Packed Encoding Rules (PER). There could be many reasons for this,but one that is commonly stated is that PER makes use of the schemaeven for parsing the surface structure of the data item, requiringsignificant tool support. There are different versions of the ASN.1schema language in use, which has also hampered adoption.¶

E.2.MessagePack

[MessagePack] is a concise, widely implemented counted binaryserialization format, similar in many properties to CBOR, althoughsomewhat less regular. While the data model can be used to representJSON data, MessagePack has also been used in many remote procedurecall (RPC) applications and for long-term storage of data.¶

MessagePack has been essentially stable since it was first publishedaround 2011; it has not yet had a transition. The evolution ofMessagePack is impeded by an imperative to maintain complete backwardscompatibility with existing stored data, while only few bytecodes arestill available for extension. Repeated requests over the years fromthe MessagePack user community to separate out binary and text stringsin the encoding recently have led to an extension proposal that wouldleave MessagePack's "raw" data ambiguous between its usages for binaryand text data. The extension mechanism for MessagePack remainsunclear.¶

E.3.BSON

[BSON] is a data format that was developed for the storage ofJSON-like maps (JSON objects) in the MongoDB database. Its majordistinguishing feature is the capability for in-place update,which prevents a compact representation. BSON uses a countedrepresentation except for map keys, which are null-byte terminated.While BSON can be used for the representation of JSON-like objects onthe wire, its specification is dominated by the requirements of thedatabase application and has become somewhat baroque. The status ofhow BSON extensions will be implemented remains unclear.¶

E.4.MSDTP: RFC 713

Message Services Data Transmission (MSDTP) is a very early example ofa compact message format; it is described in[RFC0713], writtenin 1976. It is included here for its historical value, not because itwas ever widely used.¶

E.5.Conciseness on the Wire

While CBOR's design objective of code compactness for encoders anddecoders is a higher priority than its objective of conciseness on thewire, many people focus on the wire size.Table 8 shows someencoding examples for the simple nested array [1, [2, 3]]; where someform of indefinite-length encoding is supported by the encoding,[_ 1, [2, 3]] (indefinite length on the outer array) is alsoshown.¶

F.1.Examples of CBOR Data Items That Are Not Well-Formed

This subsection shows a few examples for CBOR data items that are notwell-formed. Each example is a sequence of bytes, each shown inhexadecimal; multiple examples in a list are separated by commas.¶

Examples for well-formedness error kind 1 (too much data) can easilybe formed by adding data to a well-formed encoded CBOR data item.¶

Similarly, examples for well-formedness error kind 2 (too little data)can be formed by truncating a well-formed encoded CBOR data item. Intest suites, it may be beneficial to specifically test with incompletedata items that would require large amounts of addition to becompleted (for instance by starting the encoding of a string of a verylarge size).¶

A premature end of the input can occur in a head or within the encloseddata, which may be bare strings or enclosed data items that are eithercounted or should have been ended by a "break" stop code.¶

End of input in a head:

18, 19, 1a, 1b, 19 01, 1a 01 02, 1b 01 02 0304 05 06 07, 38, 58, 78, 98, 9a 01 ff 00, b8, d8, f8, f9 00, fa 0000, fb 00 00 00¶

Definite-length strings with short data:

41, 61, 5a ff ff ff ff 00,5b ff ff ff ff ff ff ff ff 01 02 03, 7a ff ff ff ff 00, 7b 7f ff ffff ff ff ff ff 01 02 03¶

Definite-length maps and arrays not closed with enough items:

81, 8181 81 81 81 81 81 81 81, 82 00, a1, a2 01 02, a1 00, a2 00 00 00¶

Tag number not followed by tag content:

c0¶

Indefinite-length strings not closed by a "break" stop code:

5f 41 00, 7f 61 00¶

Indefinite-length maps and arrays not closed by a "break" stop code:

9f, 9f 01 02, bf, bf 01 02 01 02, 81 9f, 9f 80 00, 9f 9f 9f 9f 9f ffff ff ff, 9f 81 9f 81 9f 9f ff ff ff¶

A few examples for the five subkinds of well-formedness error kind 3(syntax error) are shown below.¶

Subkind 1:

Reserved additional information values:

1c, 1d, 1e, 3c, 3d, 3e, 5c,5d, 5e, 7c, 7d, 7e, 9c, 9d, 9e, bc, bd, be, dc, dd, de, fc, fd, fe,¶

Subkind 2:

Reserved two-byte encodings of simple values:

f8 00, f8 01, f8 18, f8 1f¶

Subkind 3:

Indefinite-length string chunks not of the correct type:

5f 00 ff,5f 21 ff, 5f 61 00 ff, 5f 80 ff, 5f a0 ff, 5f c0 00 ff, 5f e0 ff, 7f41 00 ff¶

Indefinite-length string chunks not definite length:

5f 5f 41 00 ff ff, 7f 7f 61 00 ff ff¶

Subkind 4:

Break occurring on its own outside of an indefinite-length item:

ff¶

Break occurring in a definite-length array or map or a tag:

81 ff,82 00 ff, a1 ff, a1 ff 00, a1 00 ff, a2 00 00 ff, 9f 81 ff, 9f 82 9f81 9f 9f ff ff ff ff¶

Break in an indefinite-length map that would lead to an odd number of items(break in a value position):

bf 00 ff, bf 00 00 00 ff¶

Subkind 5:

Major type 0, 1, 6 with additional information 31:

1f, 3f, df¶

G.1.Errata Processing and Clerical Changes

The two verified errata on RFC 7049,[Err3764] and[Err3770], concernedtwo encoding examples in the text that have been corrected(Section 3.4.3: "29" -> "49",Section 5.5: "0b000_11101" ->"0b000_11001"). Also, RFC 7049 contained an example using the numericvalue 24 for a simple value[Err5917], which is not well-formed; this example hasbeen removed. Errata report 5763[Err5763] pointed to an error in thewording of the definition of tags; this was resolved during a rewriteofSection 3.4. Errata report 5434[Err5434] pointed out that the Universal Binary JSON(UBJSON) exampleinAppendix E no longer complied with the version of UBJSONcurrent at the time of the errata report submission. It turned out that theUBJSON specification had completely changed since 2013; this exampletherefore was removed. Other errata reports[Err4409][Err4963][Err4964] complained that the map key sorting rules for canonical encoding wereonerous; these led to a reconsideration of the canonical encodingsuggestions and replacement by the deterministic encoding suggestions(described below). An editorial suggestion in errata report 4294[Err4294] was alsoimplemented (improved symmetry by adding "Second value" to a commentto the last example inSection 3.2.2).¶

Other clerical changes include:¶

• the use of new xml2rfc functionality[RFC7991];¶
• more explanation of the notation used;¶
• the update of references, e.g., from RFC 4627 to[RFC8259],from CNN-TERMS to[RFC7228], andfrom the 5.1 edition to the 11th edition of[ECMA262]; the addition of a reference to[IEEE754] and importation of required definitions; the addition of references to[C] and[Cplusplus20];and the addition of a reference to[RFC8618] that further illustrates the discussion inAppendix E;¶
• in the discussion of diagnostic notation (Section 8), the "Extended Diagnostic Notation" (EDN) defined in[RFC8610] is now mentioned, the gap in representing NaN payloads is now highlighted, and an explanation of representing indefinite-length strings with no chunks has been added (Section 8.1);¶
• the addition of this appendix.¶

G.2.Changes in IANA Considerations

The IANA considerations were generally updated (clerical changes,e.g., now pointing to the CBOR Working Group as the author of thespecification). References to the respective IANA registries wereadded to the informative references.¶

In the "Concise Binary Object Representation (CBOR) Tags" registry[IANA.cbor-tags], tags in the space from 256 to 32767 (lower half of"1+2") are no longer assigned by First Come First Served; this rangeis now Specification Required.¶

G.3.Changes in Suggestions and Other Informational Components

While revising the document, beyond the addressing of the errata reports, the working group drew upon nearly seven years of experience with CBOR in a diverse set of applications. This led to a number of editorial changes, including adding tables for illustration, but also emphasizing some aspects and de-emphasizing others.¶

A significant addition isSection 2, whichdiscusses the CBOR data model and its small variations involved in theprocessing of CBOR. The introduction of terms for those variations (basic generic,extended generic, specific) enables more concise language in otherplaces of the document and also helps to clarify expectations ofimplementations and of the extensibility features of the format.¶

As a format derived from the JSON ecosystem, RFC 7049 was influencedby the JSON number system that was in turn inherited from JavaScriptat the time. JSON does not provide distinct integers and floating-pointvalues (and the latter are decimal in the format). CBORprovides binary representations of numbers, which do differ betweenintegers and floating-point values. Experience from implementation and usesuggested that the separation between these two numberdomains should be more clearly drawn in the document; language thatsuggested an integer could seamlessly stand in for a floating-pointvalue was removed. Also, a suggestion (based on I-JSON[RFC7493])was added for handling these types when converting JSON to CBOR, andthe use of a specific rounding mechanism has been recommended.¶

For a single value in the data model, CBOR often provides multipleencoding options. A new section (Section 4) introduces the term"preferred serialization" (Section 4.1) and defines it for variouskinds of data items. On the basis of this terminology, the sectionthen discusses how a CBOR-based protocol can define "deterministicencoding" (Section 4.2), which avoids terms"canonical" and "canonicalization" from RFC 7049. The suggestion of "CoreDeterministic Encoding Requirements" (Section 4.2.1) enables genericsupport for such protocol-defined encoding requirements. This documentfurther eases the implementation of deterministic encoding bysimplifying the map ordering suggested in RFC 7049 to a simplelexicographic ordering of encoded keys. A description of the oldersuggestion is kept as an alternative, now termed "length-first map keyordering" (Section 4.2.3).¶

The terminology for well-formed and valid data was sharpened and morestringently used, avoiding less well-defined alternative terms such as"syntax error", "decoding error", and "strict mode" outside of examples.Also, a third level of requirements that anapplication has on its input data beyond CBOR-level validity is now explicitly called out.Well-formed (processable at all), valid (checked by avalidity-checking generic decoder), and expected input (as checked bythe application) are treated as a hierarchy of layers ofacceptability.¶

The handling of non-well-formed simple values was clarified in textand pseudocode.Appendix F was added to discuss well-formednesserrors and provide examples for them. The pseudocode was updated tobe more portable, and some portability considerations were added.¶

The discussion of validity has been sharpened in two areas. Mapvalidity (handling of duplicate keys) was clarified, and the domain ofapplicability of certain implementation choices explained. Also,while streamlining the terminology for tags, tag numbers, and tagcontent, discussion was added on tag validity, and the restrictionswere clarified on tag content, in general and specifically for tag 1.¶

An implementation note (and note for future tag definitions) was addedtoSection 3.4 about defining tags with semantics that depend onserialization order.¶

Tag 35 is not defined by this document; the registrationbased on the definition in RFC 7049 remains in place.¶

Terminology was introduced inSection 3 for "argument" and "head",simplifying further discussion.¶

The security considerations (Section 10) were mostly rewritten and significantlyexpanded; in multiple other places, the document is now more explicitthat a decoder cannot simply condone well-formedness errors.¶