CBOR Format Details – Guide 2026

[Student]

(From RFC 8949 – the official CBOR spec – and real usage in FIDO2/WebAuthn, EMV, IoT – December 2025)

What is CBOR? CBOR (Concise Binary Object Representation) is a binary data serialization format designed to be:

• Compact (smaller than JSON)
• Fast to encode/decode
• Extensible
• Self-describing (types + lengths encoded)

It’s the binary equivalent of JSON but optimized for constrained devices (IoT, smart cards, FIDO keys).

Key 2025 Stats:

• Used in FIDO2/WebAuthn (passkeys), EMV cryptograms, CoAP, CWT (CBOR Web Token).
• >50 % smaller than JSON on average.
• Hardware support in most secure elements (NXP JCOP, ST33, Apple Secure Enclave).

CBOR Basic Structure (Byte-by-Byte)​

Every CBOR item starts with a header byte:

+--------+--------+-------------------------------------------------+
| Major  | Additional | Value / Length                                  |
| Type   | Info     |                                                 |
| (3 bits)| (5 bits) |                                                 |
+--------+--------+-------------------------------------------------+

Major Types (first 3 bits):

Major	Type	Description
0	Unsigned integer	0 to 2^64-1
1	Negative integer	-1 to -2^64
2	Byte string	Arbitrary bytes
3	Text string	UTF-8 text
4	Array	Ordered list
5	Map	Key-value pairs
6	Tag	Semantic tagging (e.g., date, decimal)
7	Simple / float	bool, null, float16/32/64, break

Additional Info (last 5 bits):

Value	Meaning
0–23	Direct value (header byte contains data)
24	Next byte = 8-bit value
25	Next 2 bytes = 16-bit value
26	Next 4 bytes = 32-bit value
27	Next 8 bytes = 64-bit value
28–30	Reserved
31	Indefinite length / break

Real CBOR Examples (2025 Common Data)​

Example 1 – Simple Map (JSON equivalent: {"name": "John", "age": 30})

Hex:

A2                                      # map with 2 items
   64                                   # text string length 4
      6E616D65                          # "name"
   64                                   # text string length 4
      4A6F686E                          # "John"
   63                                   # text string length 3
      616765                            # "age"
   1E                                   # unsigned 30

Example 2 – Array of Integers [1, 2, 3]

Hex:

83                                      # array with 3 items
   01                                   # 1
   02                                   # 2
   03                                   # 3

Example 3 – FIDO2/WebAuthn AuthenticatorData (Real Passkey Example)

Typical authenticatorData (from passkey login):

49 61 6D 20 61 20 70 61 73 73 6B 65 79 ... (truncated)

• First 32 bytes: SHA-256 of RP ID
• Byte 33: Flags (UP, UV, AT, ED)
• Bytes 34–37: Sign count (ATC)
• Rest: Attested credential data or extensions

Why CBOR Is Used in Security (2025 Reasons)​

Reason	Benefit
Compact size	Smaller payloads → faster NFC/Bluetooth
Deterministic encoding	No ambiguity → perfect for signatures
Self-describing	Types + lengths built-in
Extensible tags	Semantic meaning (dates, big nums)
Binary	No text parsing overhead

Common CBOR Tags in 2025 (From RFC 8949)​

Tag	Meaning	Example
0	Date/time string	"2025-12-17T12:00:00Z"
1	Epoch timestamp	1736961600
21	Negative bignum	-2^100
55799	Self-describe CBOR	For debugging

Bottom Line – December 2025​

CBOR is the binary, compact, secure replacement for JSON – mandatory in FIDO2, EMV cryptograms, IoT. Header byte = major type + additional info → everything self-contained.

For developers: Use cbor2 (Python) or tinycbor (C) libraries.

Want real examples? DM for “CBOR Nuclear Pack December 2025”:

• Full CBOR encoding/decoding scripts
• FIDO2 authenticatorData examples
• EMV ARQC in CBOR

Stay technical.

Your choice.

– Based on RFC 8949 + FIDO2/WebAuthn specs (2025).