CBOR Object Type Extension (COTX)
Anders Rundgren, Ed.
Independent
Montpellier
France
anders.rundgren.net@gmail.com
https://www.linkedin.com/in/andersrundgren/
2022
Application
CBOR
CBOR
URL
Identfier
Type
This document describes a CBOR tag for providing type information to CBOR data. Unlike the native CBOR tagging scheme which builds on integers in a IANA registry, this specification supports arbitrary type identifiers, including using URLs. The latter enable type identifiers to potentially point to associated human readable definitions as well.
Introduction
This specification introduces a method for augmenting data expressed in the CBOR [RFC8949] notation, with a universal type identifier mechanism.
The primary purpose is to enable developers defining application specific type identifiers without having to go through an external registration process. Although the described scheme imposes no restrictions on type identifiers (beyond being valid CBOR data items), using URLs [URL] should due to their ubiquity be a candidate for CBOR based standards. See also Appendix A.
This specification is also intended to provide a path for ISO using CBOR as a possible alternative to XML by supporting their current URN [RFC8141] based identifier naming scheme. See also Appendix B.
Since the type identifier scheme is supposed to be an integral part of CBOR data items, objects compliant with this specification may also be embedded in other CBOR and non-CBOR constructs, as well as stored in databases without any additional information.
If applied to top level items, the type identifier scheme may also reduce the need for application specific media types. In many cases "application/cbor" should suffice.
Terminology
In this document the term CBOR "object" is used interchangeably with the CBOR [RFC8949] "data item".
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", " SHALL NOT ", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here.
Specification
This specification builds on the CBOR [RFC8949] tag feature (major type 6), by defining a fixed tag with the preliminary decimal value of 1010. See also Section 3.
This tag MUST in turn enclose a CBOR array with two elements, where the first element is assumed to contain an object type identifier, while the second element holds the object (instance) data itself. Both arguments MUST be valid (but arbitrary) CBOR objects.
The syntax expressed in CBOR diagnostic notation (section 8 of [RFC8949]) would read as:
1010([Object Identifier, Object Data])
Note that real-world usages will typically impose constraints like requiring object identifiers to be expressed as HTTPS URLs etc.
Sample
Consider the following sample:

1010(["https://example.com/myobject", {
  1: "data",
  2: "more data"
}])

Converting the sample above to CBOR expressed in hexadecimal notation (here shown with embedded comments as well), should result in the following output:

D9 03F2                             # tag(1010)
   82                               # array(2)
      78 1C                         # text(28)
         68747470733A2F2F6578616D706C652E636F6D2F6D796F626A656374
                                    # "https://example.com/myobject"
      A2                            # map(2)
         01                         # unsigned(1)
         64                         # text(4)
            64617461                # "data"
         02                         # unsigned(2)
         69                         # text(9)
            6D6F72652064617461      # "more data"

In a typical implementation "https://example.com/myobject" would also serve as a hyper-link to human readable information about the identifier, accessed through a Web browser.
IANA Considerations
In the registry [IANA.cbor-tags], IANA is requested to allocate the tag defined in Table 1.
Values for Tag Numbers
Tag | Data Item | Semantics | Reference
1010 | array: [id, object] | Object identifier | draft-rundgren-cotx
Security Considerations
This specification inherits all the security considerations of CBOR [RFC8949].
URL-based type identifiers MUST NOT be used for automatically downloading CBOR schema data like CDDL [RFC8610] to CBOR processors, since this introduces potential vulnerabilities.
The availability of type information does in no way limit the need for input data validation.
For signed CBOR objects, it is RECOMMENDED to include the type identifier extension in the signature calculation as well. The same considerations apply to encryption using AEAD algorithms.
References
Normative References
[IANA.cbor-tags]

Concise Binary Object Representation (CBOR) Tags
Internet Assigned Numbers Authority
19 September 2013
Informative References
[XSD]

XML Schema Definition Language (XSD) 1.1 Part 1: Structures
W3C
[URL]

Living Standard — Last Updated 3 May 2022
What WG
[RFC8949]
[RFC8141]
[RFC2119]
[RFC8174]
[RFC8610]
[RFC4151]
[RFC5141]
URI and URL Identifiers
The primary reason for using URI or URL [URL] based identifiers is for maintaining a single name-space for the entire specification of a system. Note that the referenced URL specification does not distinguish between URIs and URLs.
A core issue with identifiers depending on host (DNS) names is that host names may not necessarily remain valid during the anticipated life time of an identifier. The originator of a host name may due to organizational changes, neglect, lack of interest, or even death, lose control over its use, effectively leaving associated identifiers orphaned.
This non-normative section describes different methods for dealing with identifiers expressed as URIs or URLs.
Registering a Dedicated Domain
Creating a dedicated domain may be tempting but unless the domain is backed by either an organization having multiple uses of the domain or a genuine standards organization, there is a risk that it might not survive in the long run.
Using a Sub-domain
An alternative is using a dedicated sub-domain belonging to an entity that is likely to survive for an overseeable future. With the advent of public repositories like GitHub, this appears to be a simpler, cheaper, and more robust solution than maintaining dedicated domain names.
The 'tag' URI Scheme
For applications where strict control over the name-space is hard to achieve, the 'tag' URI scheme [RFC4151] may be used.
URN Identifiers
ISO currently use URN [RFC8141] [RFC5141] based identifiers like "urn:iso:std:iso:20022:tech:xsd:pain.001.001.10" for data definitions using XML schema [XSD]. This method could be applied to CBOR and CDDL [RFC8610] as well.
Acknowledgements
People who have contributed with valuable feedback to this specification include Christian Amsüss, Carsten Bormann, and Joe Hildebrand.
Document History
[[ This section to be removed by the RFC Editor before publication as an RFC ]]
Version 00:
- Initial publication.
Version 01:
- IANA reference update.