[Cbor] Re: Private tag numbers / 1010

[Anders Rundgren <[e-mail]>]

On 2024-12-15 06:44, Carsten Bormann wrote:
> On 15. Dec 2024, at 06:18, Anders Rundgren <[e-mail]> wrote:
>>
>>>
>>> Regarding https://datatracker.ietf.org/doc/draft-rundgren-cotx/05/ of
>>> tag 1010, please provide ability for identifier to be a non-text string
>>> until this is not an RFC.
>>
>> Well, for unknown reasons
> 
> (You can find discussion in the records of the mailing list.)
> 
>> the CBOR WG have rejected the by other formats firmly established method using dereferenceable specification URLs as object identifiers,
> 
> Actually, over in T2TRG we are looking at the subject of dereferenceable identifiers [1], so it’s not like we don’t care.  It just turned out there wasn’t a lot of appetite for URIs as type identifiers in the CBOR WG.

Right, because the CBOR WG do not see CBOR as a JSON replacement.  This is a core idea behind my work including the use of deterministic encoding to get rid of dressing everything crypto in Base64Url notation.  Works like a charm:
https://cyberphone.github.io/wallet-core/doc/#2.4.payer-authorization
Converting this to JOSE would make grown man cry :)


> (Note that there is RFC 9090, which defines tags for another identifier scheme, ASN.1 OIDs, but didn’t go ahead to do the tag-1010-like type identifier/data item pairing — it apparently never occurred to us in the seven-year history of this RFC that this might be useful (*).)
> 
> So I wouldn’t use the term “rejected”, more like “not picked up”.
> (It may have played a role that CBOR already has an excellent type identifier mechanism, the tag.)

It is excellent for standard tags.  For private or community based identifiers, URLs and OIDs represent viable alternatives.


> And you did get the tag 1010 that does exactly what you specified it to do.
> 
> [1]: https://www.ietf.org/archive/id/draft-bormann-t2trg-deref-id-04.html
> [2]: https://www.rfc-editor.org/rfc/rfc9090
> 
>> so it seems COTX will remain my private "invention" :)
> 
> I hope you don’t have patent claims on this; the tag registry is there for everyone to use.

I believe there is considerable "prior art" so I won't try to patent that :)
In fact, I do what I can to "destroy" as much IPR as possible through defensive publications.


> 
>> Anyway, I'm not a fan of "polymorphic" tags so I would urge you to seek a new tag number
> 
> Here I agree.
> 
>> (hopefully a bit more compact than 1010), for a version using a binary argument.
> 
> Well, “a binary argument” is not really very specific.
> If we believe attaching type identifiers to data items is important, we should try to make them useful by being well-defined.

OK, then I would settle for bstr (like COSE's "kid") because that gives you highest flexibility.

Anders
> 
> Grüße, Carsten
> 
> (*) Even knowing that ASN.1 has had ANY DEFINED BY since about 1984…
> 
> 
>