Session Date/Time: 04 Mar 2026 15:00

CBOR

Summary

The CBOR Working Group met to discuss the draft-ietf-cbor-preferred-plus-04 document, focusing on recent changes, open issues, and a significant discussion around the concept of "partial implementations" and its relation to interoperability and serialization definitions. Key changes to the draft included the renaming to "Preferred Plus," removal of a deterministic serialization appendix, and an expanded introduction. A major point of contention and discussion revolved around clarifying how the document addresses interoperability in the context of various CBOR implementations, particularly those in constrained environments. The discussion on test vectors was deferred to the upcoming IETF 125 meeting.

Key Discussion Points

Draft-04 Updates

Lawrence provided an overview of the changes in draft-ietf-cbor-preferred-plus-04:

Renamed "ordinary" to "preferred plus."
Removed Appendix C, which defined deterministic serializations for common tags.
Expanded the introduction to include rationale, addressing previous discussions and comments from Karsten.
Renamed control operators to .pref-p (aligning with Preferred Plus) and .dtrm (for deterministic, as .det was taken). The names are open to suggestions.
Numerous wording improvements were made, incorporating Rohan's review feedback.

Open Issues

Five open issues were identified:

Security Considerations: Rohan has been requested to write this section.
COSE Example Appendix: Minor wording improvements planned.
Appendix B (Data Model Determinism/ADLR): Rohan suggested moving this appendix to the main body of the document. This was not discussed in detail in this meeting.
NANs Appendix: This appendix, comprising five pages of the 34-page document, discusses Not-a-Number (NAN) explanations. There was a discussion about moving it elsewhere (e.g., another document, a wiki) to reduce clutter. A sense of those present indicated support for moving it. Vadim preferred keeping it in the document.
Examples and Test Vectors: Identified as the bulk of remaining work. This discussion was deferred to IETF 125.

"Preferred Plus" Naming

The renaming to "Preferred Plus" was generally well-received. Lawrence noted that updating his qcbore library to use the new term was low impact and easy. Joe confirmed he had no issue with the name.

Introduction, Interoperability, and "Partial Implementations"

Karsten raised a concern about the introduction's wording, stating it might mischaracterize CBOR as leading to "non-interoperable serialization" if not used carefully. He argued that CBOR was designed with support for partial implementations and that the motivation for the document needed clarification.

Lawrence clarified that the intent was to highlight that CBOR's design allows choices that can lead to non-interoperable outcomes if not explicitly managed (e.g., definite vs. indefinite lengths).
Joe suggested anchoring the discussion in "partial implementations" for constrained devices, proposing wording like: "CBOAR is interoperable between full implementations; however, when desiring partial implementations, for example, in constrained devices, care must be taken..." This approach was generally well-received.
Karsten proposed that the document could provide value by identifying a "very small set of partial implementations that we actually... [endorse]," allowing protocol developers to reference these "licenses" using short terms. This would avoid repeated redefinitions.
This led to a discussion of which partial implementations might be sensible to endorse:
- No floats (or restricted float handling, like flushing subnormal numbers to zero).
- No indefinite length items.
- Restrictions on map key types (e.g., not strings or integers).
- No Big Ents (bignums).
- No custom symbols.
- No undefined values.
- No negative zero floats.
- A sense of those present indicated that not supporting simple values other than true/false/null was not a desirable partial implementation to endorse, as it could lead to broad neglect and interoperability issues.
Lawrence emphasized the distinction between serialization (this document's focus) and data model (orthogonal). While the document is neutral on data types, it needs to be careful in its wording. It was suggested that a section on partial implementations could also be a suitable place for data model restrictions like the NAN discussion, addressing Karsten's point about it not being strictly a serialization issue.

"Preferred Plus" Determinism and Orthogonality

Karsten expressed concern about the slide's statement "preferred plus is deterministic, except for maps," arguing that properties described with exceptions are problematic, especially for security.

Lawrence clarified that the document text is more precise, stating: "deterministic is preferred plus with maps sorted."
Karsten further argued that "Preferred Plus" might violate the orthogonality between serialization and data model restrictions due to its handling of NAN payloads and tags 2 and 3. Lawrence and Joe felt the impact was minor in practice for most users, but acknowledged the conceptual point. Agreement was to see if the proposed "partial implementation" section could address this.

Karsten's "Interoperability Constraints" Presentation

Karsten used slides to argue against making "preferred serialization" an interoperability constraint.

He agreed that "definite length only" (DLO) is a clear and beneficial interoperability constraint, as it provides a tangible benefit to decoders (not needing to implement indefinite length decoding).
However, he contended that "preferred serialization" itself (outside of determinism) offers no decoder benefits for partial implementations, as decoders must already handle variations. It primarily offers encoder-side benefits.
He expressed concern that making preferred serialization an interoperability constraint could misguide decoders into rejecting valid CBOR, thereby splitting the ecosystem. He advocated for test vectors as the primary mechanism to help the community.
Lawrence countered that IETF protocols must specify serialization precisely. "Preferred Plus" aims to simplify this for end-to-end protocols (e.g., CTAP, file system protocols). The issue is not with libraries, but with protocol definitions not being sufficiently precise about their serialization requirements. If a protocol specifies Preferred Plus and doesn't use floats, implementers will quickly discover if their library doesn't support the required data types or serialization.

Decisions and Action Items

Action: Lawrence: Update draft-ietf-cbor-preferred-plus to include a section on partial implementations, incorporating the discussed types of restrictions (no floats, no indefinite length, etc.).
Action: Lawrence: Rephrase the introduction text regarding non-interoperability, aligning it with the consensus on focusing on full vs. partial implementations in constrained environments.
Decision: The discussion on test vector strategy is deferred to the IETF 125 session.
Action: Lawrence: Prepare an initial version of the test vector plan for inclusion in the next draft.
Action: Lawrence: Aim to release a new version of the draft with the partial implementation content and initial test vector plan as soon as possible, potentially via a manual posting prior to the IETF 125 moratorium lift.

Next Steps

Further discussion on the draft-ietf-cbor-preferred-plus document will continue on the mailing list.
The next meeting will be held at IETF 125.
The proposed agenda for IETF 125 includes:
- Continued discussion of issues in the serialization document (60 minutes).
- Discussion of the test vector strategy.
- An early agenda item will be added to discuss the status of other documents like CWAP Act and EDN, and the overall focus of the working group, especially with Paul Wouters (AD) present.