[Cbor] Why draft-cbor-cde -- serialization issues in RFC 8949

[Laurence Lundblade <[e-mail]>]

Here’s an email form of what I presented at the interim meeting <https://datatracker.ietf.org/doc/slides-interim-2025-cbor-07-sessa-serialization-issues-in-rfc-8949/> yesterday. No solutions, just being clear about the serializations issues in RFC 8949.

LL


=== #1 Definite Lengths not Required for Preferred Serialization ===
RFC 8949 preferred serialization allows indefinite lengths. None of the other preferred serialization “preferences” have exceptions.


=== #2 RFC 8949 Restates Requirements ===
Naming Reminder
• CDER: Core Deterministic Encoding Requirements, Section 4.2.1 of RFC 8949
• CDE: Common Deterministic Encoding, Section 3 of draft-cbor-cde

• Section 4.1 describes preferred serialization as a series of preferences
• Section 4.2.1 describes CDER based on preferred serialization. It restates preferred serialization requirements in normative form
• They diverge on definite-lengths
• Implementers need to read both and cross-check
• Restatement is perhaps suboptimal


=== #3 CDER Doesn’t Cover Big Numbers ===
• Preferred serialization in RFC 8949 puts requirements on big numbers
• CDER’s restatement of preferred serialization in RFC 8949 doesn’t include big numbers
• CDE adds determinism for big numbers

In the meeting yesterday, Carsten said you can read the text to mean that big numbers are part of CDER and thus CDE is not a change. However, you can read it the other way too and we agree that the text could use improving.


=== #4 Tags Lack Preferred/Deterministic Serialization ===
• Preferred serialization for tags 2 and 3 in RFC 8949
• Deterministic serialization for tags 2 and 3 in draft-cbor-cde
• No preferred or deterministic serialization for tags 0, 1, 4, 5, 36, 257 in either document


=== #5 Full and General Data Model Determinism ===
• There’s little (no?) discussion of determinism beyond tags in RFC 8949
• dCBOR is an example that data model determinism is not just about tags
• Discussion beyond what is in RFC 8949 was needed, so ALDR was created