**Session Date/Time:** 23 Jul 2026 09:30

[00:00:06] **Christian Amsüss**: K. Hello, everyone. Welcome to my favorite city in Vienna and to the meeting of the CBOR working group at IETF 120. My name is Christian Amsüss. This is Paul Hoffman, and Barry Leiba is joining us remotely as the third chair of this group. We are an official IETF meeting. So even though you've seen this a lot a lot of times, please hello, Barry. Good to see you. Please please have a look at it. This is the note well. It describes all the thing it it describes many of the things you've already agreed to in terms of procedures and policies that apply to meetings such as this. We're using the tools that you're probably already familiar with, which is the which is the the MeetEcho tool for local and remote participation. Please especially use the queue button on your phone or on your laptop to to end may enter the queue so that, in particular, remote participants easily see who is talking and that we get a we can manage who is joining. Yeah. If you're using your laptop, please mute please mute everything. And with that, let's have a look at the agenda through which we were going through here. So introduction is what we're doing now, and there are two large topics that we like to talk about today. One is CBOR serialization where Lawrence is writing a draft, and I haven't seen him online. Yeah. He is online now, so he will be presenting status update here remotely. And the second block for about the second half of the one hour meeting will be about EDN literals or CDN these days, where our focus will not be on the concrete technical changes that people want to still make, but on the procedure that as a working group, we can use to decide what we still want to do without dragging on indefinitely and without getting into situations where we cannot find consensus on document. Because if we cannot find rough consensus on document, there is nothing we can publish there at all, and we'd have to drop the work. So we are trying to find ways into a situation where we find where everyone can agree on what we'll eventually produce here. Is there anything that you'd like to alter or add to the agenda at the last moment? Hearing none, I'll switch over to the slide deck that Lawrence has prepared, and I'll pass if that's fine with you, I'll pass slide control to you so that you can advance the slides yourself.

[00:03:06] **Lawrence Lundblade**: Okay. And can everybody hear me?

[00:03:09] **Christian Amsüss**: Yes. Thank you.

[00:03:11] **Lawrence Lundblade**: Alright. I don't know. Is it afternoon there? It's, middle of here. Okay. So first, I just got three slides. First is the, recent publication of draft o seven. Had a fair number of changes to it, including the the addition of sample source code for including encoding floats for preferred plus and deterministic serialization. That was an adaptation of the code in, Carsten's, I can't remember a draft. The the the the determinism draft, CDE draft. K. The, second thing, the CDDL control operators for preferred plus and deterministic were replaced with one control operator called dot serial so they can work on any C More item. It's been shared. Some discussion was shared with working group on that. There were some rework on the sections on general and special serializations. So a lot of text moved around, but nothing dramatically changed. A shorter and more to the point section on when to use preferred plus, then generally, wording improvements in the intro and other minor corrections in formatting. So not really any, mostly subjective changes. I guess the really, substantial change that affects would be the dot pref p and dot or being and the dot d t r m being replaced with dot serial. And I haven't had any negative feedback on that, although there was some discussion about possibly just not having CDDL operators at all. So that's that's draft o seven that's been out there for a couple of weeks. Not really too much discussion on it. There are two open issues that there's already a lot of progress on. One is signing and hashing. That's a description of of how to do signing and hashing of Cboe. And this came to light when we realized that the bundle protocol and the c509 protocol did things quite differently than COSE. And it seemed like there was a lot of back and forth discussion. I mean, also Anders has his signing design that is not doesn't use byte byte string wrapping. So this this is an appendix, being added that discussions the trade off, for byte string wrapping in relation to not using byte string wrapping. And that is for both the the decoding part and also how well it works as describing and then, you know, indicating which bytes are to be signed or hashed. So there is a a PR in the GitHub that is ready for review. And I I guess since Paul will ask, I will share it on the mailing list in the next day or so. Another issue is Fay Amacker asked for some clarification on nontrivial nouns and, you know, whether a CBOR library in particular should normalize or reject nontrivial nouns. We seem to have consensus on the list, and that that consensus is that it's up to the library or application to decide. That's there's not a fixed, you know, design or requirement for that. So there's a minor PR for that in process. Rohan.

[00:07:43] **Rohan Mahy**: Yeah. Rohan Mahy. Regarding the NAND that they use for the regarding the the NAND that Fay's Go library uses or the go uses internally. Yeah. I think we should just be clear on what the semantics are of the nontrivial NaN, that that is that that is the NaN that you would expect to be used. And the fact that the Go library does something different, Well, you know, that's kind of they're they're a little bit off in the rough, but it's sort of okay to be off in the rough. But what we wanna do is make sure that it's clear what not being in the rough means. Thank you.

[00:08:33] **Christian Amsüss**: Ask the person.

[00:08:35] **Rohan Mahy**: Yeah.

[00:08:40] **Carsten Bormann**: I think the the interesting observation here is that there is a general problem how to map the CBOR data metal model into specific platforms. Each platform has its little problem there. And maybe we can use this as as a trigger to actually go ahead and and discuss a few strategies. So for instance, that there are platforms that that don't have certain data types that are in the this CBOR generic data model. So what do you do in in this case? And solutions have been developed for that, and maybe it's not necessarily that people reinvent further solutions if these have turned out to be satisfactory.

[00:09:32] **Paul Hoffman**: Actually, Carsten, did you mean in this to discuss it in this document or maybe a new document that could be more omnibus with a section for each language?

[00:09:43] **Carsten Bormann**: So if you ask me

[00:09:45] **Paul Hoffman**: I am asking you.

[00:09:46] **Carsten Bormann**: Thank you.

[00:09:47] **Paul Hoffman**: You and I will disagree, but I'm asking you. Yes.

[00:09:51] **Carsten Bormann**: I think it would be a good thing to have a document that that is going to implement us and to have a document that is going to people who excuse me. To CBOR library implementers and a document that is going to people who are designing protocols and who are implementing those protocols.

[00:10:13] **Paul Hoffman**: Who need to know about the different libraries and such or to at least understand that there are library differences for that latter group.

[00:10:25] **Carsten Bormann**: Yeah. So the the the exact boundary for that is definitely an interesting question.

[00:10:31] **Christian Amsüss**: Yeah.

[00:10:32] **Carsten Bormann**: Okay. But Lawrence has has rejected some some proposal I have made based on the idea this is too complicated. And I think different audiences have different levels, different thresholds on too complicated. So it's really difficult to write a draft that addresses all these audiences in a satisfactory way.

[00:10:59] **Paul Hoffman**: So I was wrong a moment ago. You and I agree on this if this is a separate document. I think that that would be useful. It doesn't necessarily even have to be part of the working group, but I I definitely agree it'd be useful. One correction I wanted to make on that the Go library to the statement, the Go library does it this way. The Go library currently does it this way. That is as as this document is finished, in fact, they may look and go like, oh, we can do it a different way. Oh, it's gonna break two people, and it's gonna now follow everything else. And then that would also tie into the suggestion Carsten just made of we can, in fact, if we have a separate document that's going language by language, it can also go epoch by epoch. I've been around the Python, you know, environment long enough to know that they sometimes fix these things and sometimes they absolutely do not and whatever, that's actually valid information for users of CBOR. So thanks. I'm sorry. I didn't say this was Paul Hoffman.

[00:12:13] **Lawrence Lundblade**: I'm gonna comment twice, respond to those comments twice, once as document author, which is my read of the working group is that the working group is in favor of only the nontrivial NAAM being the only NAAM and that the working group thinks it's too complex, and that is the reason. It's not my opinion. It's it's my read of the consensus of the working group, and I'm gonna do personally support that as well. I mean but but I don't know if you recall. I mean, I maybe a year ago, I was of a different opinion. I actually was didn't wanna tweak the data model. So as a document author, I'm trying to follow the consensus here.

[00:13:05] **Christian Amsüss**: Much appreciated. The

[00:13:09] **Lawrence Lundblade**: second thing I'd like to say from personal point of view is I think we've spent an an absolutely ridiculous amount of time on this topic. And one of the reason for a feature that nobody uses that really you can't even find a use case for it. So I actually am quite opposed to any further discussion on it. I I'd ask the chairs to kinda think about that of, you know, whether we're gonna write more documents or talk about it anymore. But I would really like to see this and just no more discussion on this. And I believe that there is consensus for what's in the document today.

[00:13:47] **Paul Hoffman**: With the.

[00:13:49] **Carsten Bormann**: Yep.

[00:13:49] **Paul Hoffman**: So once you have, speaking together here, once you have that PR published, I believe that should end discussion. And if people want something different, they have to do new words. But I agree with you. It has been discussed extensively.

[00:14:04] **Christian Amsüss**: Yeah. So do I.

[00:14:07] **Lawrence Lundblade**: Yeah. The PR is is only a very minor adjustment to what's in the document. It's just a minor clarification. It's nothing

[00:14:14] **Paul Hoffman**: Excellent.

[00:14:14] **Lawrence Lundblade**: Nothing more than that.

[00:14:16] **Paul Hoffman**: Yep.

[00:14:19] **Lawrence Lundblade**: So there's one extra bonus on this slide that I didn't mention that this come came up in the last few hours. I I've been reviewing the c509 protocol, and I think there's a also a little tweak to be made to the the way the big numbers are represented in CDDL. I won't go into that today. Just I don't I think it's too much to too fussy and detailed to talk, and I'm not prepared. But I just wanna mention that as something. And, let me go on to the next slide, which is next steps. So my plan is to publish a o eight draft by July 27. I think that's next Monday. And in that draft, the changes will be the, the new security consideration section on covert channels. That was, you know, the delivered by, Rohan. The minor wording and correction oh, there was a bunch of minor wording wording and corrections from Fay Amacker. Nothing to do with NANs, just a general very nice, neat little PR that fixed a few things. I plan to add a an appendix on signing and hashing, which is the most substantial change in draft o eight. And it and, you know, I'm adding that because I believe there's a lot of misunderstanding about how to do signing and hashing of CBOR and evidenced by the, you know, the discussions around c509 and the bundle protocol. And then the very minor, text improvement around NAMS and then also a minor, tweak on the way to use CDDL for big numbers. So and I I believe at that point, we are ready for working group last call.

[00:16:27] **Carsten Bormann**: Yep.

[00:16:29] **Christian Amsüss**: I think I think that I agree that this is probably the point where we will start that start doing that. Thanks a lot. That was that was good progress. Are there more comments that we that people want to raise now around this presentation or the topic of serialization? Hearing none. Thanks a lot.

[00:16:54] **Paul Hoffman**: Okay. We're working forward to Monday.

[00:16:58] **Christian Amsüss**: Yes. And that brings us into the second last probably and that brings us into the second slot for today, which is on on CDM. The last the the last things that happened around CDN, and I'll recap them particularly because they happened largely in aft after the cutoff, are that, one, has taken the editorial items that have come up that would ease further discussion into a dash 27. So if you have not read that, even though we kind of generally accept people that have read the drafts, but that was submitted after the cutoff. If you have not read that, it's it's a lot of restructuring in terms of which section goes where, which was requested by people reviewing the document. And this will also be our starting point for finding the last pieces and that that we need to find consensus on and possibly by removing features or by fixing things that we found are actually not implemented or otherwise broken. We asked on the list for for suggestions on by which criteria or by which workflows we best do that, and Joe has provided a very good starting point for that with lot of input that came from from many of you. So that's the the that's the plan that I that we sent out during this week that basically says, we are starting from the things that are in dash 27. Focus take take the things that have been in there ever since RFC eighty nine forty nine and and eighty six ten as, like, a baseline with a few other basic criteria that we want to uphold and then look into features where there is sufficient disagreement about whether or how to do this that we could not otherwise get consensus for and then remove those selectively if there is good technical reason to do that and the fallout is proportionate to the to to the amount of trouble there. So I won't read, like, item by item through the plan. It's on it is on the mailing list. That's our plan for going forward with this. And the as I said in the introduction, what we'd like to do focus on today is clarifying items there, finding whether this is really something that we can work to this is a framework in which we can work together on in order to get a CDN into a shape where we can eventually publish it. Karsten, you're on the queue.

[00:19:54] **Carsten Bormann**: Yeah. Just just a comment because record chairs often don't have the screen real estate to follow the chat. Joe is has not been able to participate. We did not make sure that he could. That is unfortunate.

[00:20:10] **Paul Hoffman**: It it is, but it's not necessarily for now because he certainly will be on the mailing. So I've been chatting with him on the side.

[00:20:15] **Carsten Bormann**: Oh, good. Okay. Thank you. So,

[00:20:19] **Paul Hoffman**: really, what we are interested in now and we made this might be a very short meeting. Is there anything that was posted in the list? You know, Joe had done his original list. We got some comments. Christian put up the new one the other day. Is there anything in there that seems unworkable as a process for us finding what to take out of the current draft? And then it's not like then the draft is done because, in fact, as Carsten has pointed out many times, there is some ABNF simplification that might happen. There might be ABNF changes if we take things out. There will still be with especially with the reorganization. It is unlikely that Karsten got the reorganization completely correct, and it might be that the document is more readable if because he moved these paragraphs up here that if that had a new subheading or something like that. We still will have time, but the first the next step is for us to to winnow out things that we want to winnow out. Start from there with the last bits and then go forward. So that's what we're looking for hearing, you know, today, and we'll we'll give the list another few days early next week before we start the actual process. So for those of you who have read what Christian put up, any comments at all, positive or negative? Carsten is or is is it you have your hand is still upset, an old hand.

[00:21:56] **Barry Leiba**: Oh, I'm sorry.

[00:21:56] **Paul Hoffman**: That's alright. You could have something to say. Carsten and I have started doing this routine lately. So Yeah. Yeah. So

[00:22:10] **Carsten Bormann**: I I tried not to analyze this procedure too much because well, I'm a German, so I know how to follow procedures exactly. And if I do this, yeah, you probably have to write 30 pages of procedures to be able to do that, and and we don't want to do that. So I think it it's actually okay to to have a procedure that mostly sounds reasonable, but there are corner cases where the procedure doesn't really say what needs to be done.

[00:22:50] **Paul Hoffman**: And then we might find those.

[00:22:52] **Christian Amsüss**: Yeah. And, I mean, this is not a procedure written for a machine. This is a procedure written for a working group where we all kind of try to try to do our best to collaborate.

[00:23:01] **Carsten Bormann**: Yeah. Obviously, we want LLMs to make working group decisions for for us.

[00:23:05] **Paul Hoffman**: And Right. Which is why I named the procedure after Joe. Not out yet. Right.

[00:23:09] **Carsten Bormann**: Yeah. So Joe's list was was pretty good. Yes. The the one thing that that's pretty weird to me is is the this threshold of of two people. But, yeah, I don't care. Let's see whether we reach that threshold anywhere, and then we can discuss. Right.

[00:23:31] **Paul Hoffman**: Because he's a German, and he

[00:23:40] **Karsten Bormann**: How many people are in this room?

[00:23:41] **Christian Amsüss**: Round about 30. 30. Thank you.

[00:23:44] **Paul Hoffman**: Yeah. So other comments or questions on what was posted on the list? And And and, again, we're not assuming that there are, but are is there more now? We will still have some more days on the list to look at this. But then it is our intention sometime possibly a week from now because it's a Thursday to, instantiate the process and start going. Does that sound right?

[00:24:13] **Christian Amsüss**: Yep.

[00:24:13] **Paul Hoffman**: Yep. Good. Oh, Gary, do you want anything from from remote? Oh, and Rowan?

[00:24:21] **Barry Leiba**: I'm good. Good. Thanks.

[00:24:24] **Paul Hoffman**: It this table would not have fit all three of us anyways. So There

[00:24:28] **Barry Leiba**: you go. We would have had to have had some fisticuffs in the back to decide.

[00:24:33] **Paul Hoffman**: I I I'm happy to sit in the back of the room for this.

[00:24:36] **Christian Amsüss**: Rowan? So

[00:24:40] **Rohan Mahy**: if we're done with everything else, I did wanna take advantage of the fact that we're all here in person to ask a question about the backtick No. Backticks and text.

[00:24:50] **Christian Amsüss**: No. So,

[00:24:52] **Rohan Mahy**: Carsten, I will come find you later, but it's it's just a question of, like, does this does this do ABNF? A yes or no question. Right. That's what I wanna

[00:25:02] **Christian Amsüss**: know.

[00:25:02] **Paul Hoffman**: Yep. This is not this is not a good use of of the space even though we are out of you know, we don't need time. And and quite frankly, if you two disagree I didn't

[00:25:12] **Rohan Mahy**: I didn't actually think we were going to discuss it. Okay.

[00:25:15] **Paul Hoffman**: Yep. Yeah. And and if you two disagree, I really hope that it comes to the list. Yeah.

[00:25:19] **Carsten Bormann**: Well yeah.

[00:25:20] **Rohan Mahy**: I I'm asking because I don't know the answer.

[00:25:22] **Christian Amsüss**: Right. Yeah. Great. Also, like, if and it appears like that we are concluding this working group meeting a bit earlier. Yes. Everyone who is who who who might be participating in hallway discussions on, like, particular features to prepare for for for their own proposals then on on water removal, which bugs to address, that is something that can quite well happen in hallway discussion that, like, immediately follows this meeting. We can stay in

[00:25:52] **Carsten Bormann**: the room

[00:25:52] **Christian Amsüss**: even. Even that even that. Although the mics are live.

[00:25:54] **Paul Hoffman**: I'm not sure if you wanna have those discussions with live mics. But

[00:25:58] **Christian Amsüss**: Well, the point the point is, like, this can prepare in this can be prepared in in small groups to find out what you want, what you think you can get support for so that, ideally, by the time we come to acting on this list, we have proposals where already a bit of discussion has happened, and we are not bogged down with a long list that does not get good support, but rather have particular items where there's also already a bit of argumentation that has gone on so that we can find the find the remaining parts that need the full group

[00:26:34] **Paul Hoffman**: Yeah.

[00:26:34] **Christian Amsüss**: To work on. Good.

[00:26:35] **Paul Hoffman**: Oh, and just to be clear, we know that there are other nontechnical issues in the document. Everyone's favorite, what are we gonna call the call it at the end. We are we are purposely putting those at the very end. We want to get some more technical focus now, which is what will happen soon. Those kinds of things can last forever. It's our plan to put time limits on those discussions. We know that that usually fails in this working group, but we'll try again. But we would really like people to start focusing much heavier on the technical bits. So if there's nobody else, we can close the working group now. And, again, you're welcome to stay in the room. Oh, Lawrence. Thank you.

[00:27:25] **Christian Amsüss**: Oh, yeah. You you closed the session. Yes.

[00:27:29] **Paul Hoffman**: Oh, sorry. Yeah. That that

[00:27:30] **Christian Amsüss**: would that would be a very unfortunate accident. Yeah.

[00:27:33] **Paul Hoffman**: So I'm Carsten, do you remember when John Klensin closed a working group during the working group meeting? Were you here? That would've okay. So there was an area director who actually closed a working group, surprisingly, during a working group meeting. At the end of the meeting, people gave him a giant hammer as a gift. Lawrence?

[00:27:57] **Lawrence Lundblade**: Yeah. Just a quick question about the the parallel processing of serialization and EDN, CDN. Because in the past, you'd the chairs had asked us to deal with them serially to focus on one or the other. And, so I'm just curious what the guidance is on that now. Like, we've we've been kinda doing them parallel lately, but

[00:28:24] **Christian Amsüss**: Yep. So give given given that there's sufficient structure to both discussions, I think we can well handle them in parallel and progress them at the same time without any ill effects.

[00:28:36] **Paul Hoffman**: So We will not have them in both in working group last call at the same time. Lawrence, with what you said, I think we can start working group last call on yours and have working group last call discussion as a thread as we're doing these others.

[00:28:52] **Lawrence Lundblade**: Okay. Thank

[00:28:53] **Carsten Bormann**: you. To do the right subject.

[00:28:57] **Paul Hoffman**: Thank you. Another place where Carsten and I are in agreement. What for those of you who didn't hear, he said, an admonition for you to actually use the correct subject line. Some people get really tired of me correcting their subject lines, but I'm gonna do it anyways. And our AD has just said yes.

[00:29:22] **Christian Amsüss**: Rohan, I think that's just a phantom hand here. Yes, sir. Okay. Go ahead.

[00:29:28] **Paul Hoffman**: You're

[00:29:28] **Christian Amsüss**: Okay. In that case, thanks for, I think, short but well working meeting. Thanks to to Marco and for taking good minutes of the relevant items, and looking forward to participating in hallway discussions and seeing this all play out as we plan. Barry, last word?

[00:29:50] **Barry Leiba**: Yep. Just somebody have a macaron during the break in on my behalf. Thanks for everybody for joining.

[00:30:00] **Paul Hoffman**: Yep. Thanks for wearing the appropriate t shirt.

[00:30:03] **Barry Leiba**: Yeah. There you go.

[00:30:04] **Christian Amsüss**: Thanks for being up,

[00:30:05] **Carsten Bormann**: Oli. Okay.

[00:30:07] **Paul Hoffman**: Very good.

[00:30:08] **Christian Amsüss**: Have a good day. Bye.

[00:30:13] **Paul Hoffman**: Good. And do you remember the mics are live for the next half hour? Good. I'll be able to get a real lunch.

[00:30:26] **Christian Amsüss**: The one thing I had on my list that I forgot to mention was reminding people to sign into the Blue Sheets, but, technically, that's part of the procedures they agreed to.

[00:30:34] **Carsten Bormann**: So

[00:30:34] **Paul Hoffman**: It is. And and quite frankly, we don't need a bigger room. Yeah.

[00:30:40] **Christian Amsüss**: I mean, the blue sheets do more than just the room size, but Yes. We are not having any of the relevant stuff right now in this group. So

[00:30:50] **Paul Hoffman**: Hey, AD. How did that go? Yep.

[00:30:58] **Christian Amsüss**: I am too. That's good. Yeah.

[00:31:00] **Carsten Bormann**: Yeah. Yeah.

[00:31:03] **Christian Amsüss**: That the

[00:31:04] **Paul Hoffman**: thing with Joe was just he didn't know that if he had asked us, I could have scored him

[00:31:10] **Christian Amsüss**: But but but not in the last five minutes.

[00:31:12] **Paul Hoffman**: No. No. No. No. It has to be done before the beginning of the week.

[00:31:15] **Christian Amsüss**: Yeah. Yeah. Right. He could've done that. Yeah.

[00:31:23] **Paul Hoffman**: That's fine. And I