RFC 8949

RFC 8949 is the current authoritative specification for CBOR. It maintains backward compatibility with RFC 7049 while addressing ambiguities, clarifying deterministic encoding rules, and tightening requirements for core data types.

All new implementations should reference RFC 8949 rather than RFC 7049. Existing CBOR data created under RFC 7049 remains valid under RFC 8949.

• Deterministic encoding: Stricter rules for Core Deterministic Encoding Requirements — map keys sorted by encoded form
• Preferred serialization: Defines preferred encoding for each data type (e.g., shortest integer encoding)
• Numeric reduction: Clarifies when floating-point values may be reduced (e.g., 1.0 → integer 1)
• Duplicate map keys: Explicitly states that decoders SHOULD reject duplicate map keys
• Tag clarifications: Self-describing CBOR (tag 55799, magic bytes 0xD9D9F7) more clearly defined
• String encoding: Clarifies indefinite-length string chunk requirements

Deterministic encoding ensures that the same data always produces the same byte sequence. This is critical for digital signatures (COSE) where signing and verification must operate on identical encoded forms.

• Use shortest encoding for integers (no zero-padding)
• Preferred float representation (float16 if no precision loss, then float32, then float64)
• Map keys sorted lexicographically by their encoded form (shorter keys before longer)
• No indefinite-length encoding in deterministic mode
• No duplicate map keys

• Non-deterministic encoding can break signature verification — implementations MUST use deterministic encoding for signed data
• Decoders processing untrusted input must enforce resource limits (nesting depth, total size)
• Type confusion between integer and float representations of the same value must be handled carefully