cbordecode

Overview ¶

Package cbordecode parses CBOR (Concise Binary Object Representation) per RFC 8949. CBOR is the binary JSON-like format used by COSE (signed/encrypted JWT alternative), WebAuthn / CTAP (FIDO2 hardware-token transport), Bluetooth Mesh, CoAP IoT payloads, MQTT-SN attribute encoding, and the "self-describing binary" of choice for any IoT / constrained-device flow since ~2014.

Wrap-vs-native judgement ¶

Native. CBOR is fully published in RFC 8949 with a clean 8-major-type scheme + a small dispatch table for the "additional information" sub-field that encodes either a direct argument value (0-23), a 1/2/4/8-byte argument (24/25/26/27), or an indefinite-length marker (31). Tagged values (major type 6) and simple values (major type 7) round out the model. Pasting a hex blob from a WebAuthn authenticator response, a CTAP request, a CoAP body, or any CBOR-emitting IoT device is enough — no library, no network, no key material.

What this package covers ¶

• **8 major types** per RFC 8949 §3:
• 0 unsigned integer (0..2^64-1).
• 1 negative integer (-1..-2^64).
• 2 byte string (rendered as hex; indefinite chunks concatenated).
• 3 text string (UTF-8; indefinite chunks concatenated).
• 4 array (recursive).
• 5 map (recursive; rendered as ordered list of key/value pairs to preserve duplicate keys + key ordering).
• 6 tagged value (semantic tag + nested value, with a ~30-entry well-known tag-name table).
• 7 simple value / float:
• 20 false / 21 true / 22 null / 23 undefined.
• 24 simple value (1-byte argument).
• 25 IEEE 754 half-precision float.
• 26 IEEE 754 single-precision float.
• 27 IEEE 754 double-precision float.
• 31 "break" stop code (for indefinite-length containers).
• **Argument encoding** (low 5 bits of initial byte): 0..23 direct, 24 = 1-byte uint8 follows, 25 = 2-byte uint16, 26 = 4-byte uint32, 27 = 8-byte uint64, 31 = indefinite-length marker (for byte strings / text strings / arrays / maps).
• **Indefinite-length containers**: byte/text-string chunks concatenated until 0xFF break; arrays / maps walk children until the same break code.
• **Tagged values**: ~30-entry well-known tag table covering the RFC 8949 §3.4 standard tags (0 RFC 3339 date-time string / 1 epoch-time / 2/3 unsigned/negative bignum / 4 decimal fraction / 5 bigfloat / 21/22/23 expected-base64url/base64/base16 / 24 encoded CBOR data / 32 URI / 33 base64url text / 34 base64 text / 35 regex / 36 MIME / 55799 self-describe-CBOR magic), plus the COSE tags (16 Encrypt0 / 17 Mac0 / 18 Sign1 / 96 Encrypt / 97 Mac / 98 Sign) and the WebAuthn CTAP-specific tag 24 (encoded-CBOR-data-item).
• **Floats**: IEEE 754 half precision (16-bit), single (32-bit), and double (64-bit) with NaN / Inf detection.

What this package does NOT cover (deliberately out of scope) ¶

• COSE message body decode beyond the tag — the wrapped COSE_Encrypt0 / COSE_Sign1 / etc. structures are arrays whose contents are themselves CBOR; the outer tag + array is decoded, but COSE-specific semantics (protected header / unprotected header / payload / signature) are not interpreted as named fields.
• WebAuthn / CTAP request-body schema knowledge — the CBOR is decoded as a map, but the field meanings (authData / publicKey / clientDataJSON / etc.) are not annotated.
• Strict mode validation (RFC 8949 §3.1 well-formed + §5.4 deterministic encoding) — we accept any well- formed input even if not minimally encoded; explicit non-conforming inputs (e.g. arg 24 with value < 24) are decoded as-is.
• CDDL (Concise Data Definition Language, RFC 8610) schema validation — pure decode only.