RFC 7049

Concise Binary Object Representation (CBOR)
Standards Track
October 2013
RFC Library > Data Formats & Encoding > RFC 7049
Abstract: CBOR is a binary data serialization format designed for small code size, small message size, and extensibility without the need for version negotiation. In 3GPP, CBOR is used in constrained IoT/MTC environments and in COSE (CBOR Object Signing and Encryption) for 5G security tokens.
Canonical source: https://www.rfc-editor.org/rfc/rfc7049  |  IETF Datatracker

1. Introduction

▶

CBOR is a binary format loosely based on JSON's data model (maps, arrays, strings, numbers, booleans, null) but optimized for compact encoding and efficient parsing on constrained devices. It is designed for IoT, CoAP, and other resource-constrained environments.

In 3GPP, CBOR is used with COSE for securing tokens in constrained NF communication, in CWT (CBOR Web Tokens) as a compact alternative to JWT, and for encoding structured data in NB-IoT and MTC scenarios.

2. CBOR Data Types

▶
Major Type Value Description Example
0 Unsigned integer 0 to 2^64-1 0x00 = 0, 0x18 0x19 = 25
1 Negative integer -1 to -2^64 0x20 = -1, 0x38 0x63 = -100
2 Byte string Raw bytes 0x44 0x01020304 = h'01020304'
3 Text string UTF-8 text 0x65 0x48656C6C6F = "Hello"
4 Array Ordered sequence 0x83 0x01 0x02 0x03 = [1, 2, 3]
5 Map Key-value pairs 0xA2 0x01 0x02 0x03 0x04 = {1:2, 3:4}
6 Tag Semantic annotation Tag 0 = date/time string
7 Simple/Float bool, null, float 0xF5 = true, 0xF6 = null

3. CBOR vs JSON

▶
Feature JSON CBOR
Format Text (UTF-8) Binary
Size Larger (human-readable) Compact (30-50% smaller)
Schema Schema-free Schema-free + tags for types
Binary data Base64 encoded (overhead) Native byte strings
Parsing String scanning Deterministic, length-prefixed
Number types Single number type Integer, float16/32/64, bignum
Extensibility No extension mechanism Tags (semantic annotations)

4. Security Considerations

▶
  • CBOR decoders must handle malformed input gracefully — reject indefinite-length nesting attacks
  • Integer overflow: decoders must check for overflows on platforms with limited integer sizes
  • Tag validation: semantic tags should be validated — unexpected tags could cause type confusion
  • CBOR itself provides no security — use COSE (RFC 8152) for signing and encryption