Use CWT or not?

[paulbastian]

ISO mdoc has used COSE structures with self-designed CBOR structures, while CWT has designed a "token format" similar to JWT, that is widely used whenever JOSE is used. The question is whether CWT is suitable for use in this draft?

[awoie]

WG discussion (call of 31 July 2026):

Choice of primitive

• Which primitive should be used: COSE_Sign1 or CWT? Noted that CWT is itself built on COSE_Sign1, so this is a question of payload structure and reuse rather than of two unrelated formats.
• COSE_Sign1 requires us to define most data structures ourselves. CWT allows more reuse from the existing standard - a pre-defined container and registered claims.
• CWT is an additional dependency.
• Parsing logic for anything outside the features CWT defines - for example, extracting certificates from headers - is the same either way.

Library support

• It was suggested that CWT might have broader library availability.
• It was also noted that the state of COSE_Sign1 library support may in fact be better than that of CWT. This point was not resolved and would benefit from concrete data.

Detached signatures

• Are detached signatures actually required? They may be useful for verifier authentication, and could allow a simpler data structure there.
• It was initially stated that CWT does not permit detached signatures. This was subsequently clarified: CWT does support them, though perhaps not in the form we would want.

Migration and alternatives

• If detached signatures (or similar) turn out to be required later, is it possible to migrate from CWT to COSE_Sign1?
• Is there a third option alongside COSE_Sign1 and CWT?

Related question

• COSE_Sign versus an array of COSE_Sign1 structures.

No decision was made. Discussion continues in this issue.

[awoie]

Thanks all for the discussion on this - I've posted a summary above.

One thing that struck me listening back: a lot of the arguments on both sides depend on whether we need detached signatures, and we never actually answered that. I'd rather we sorted that out first and then took the format question with it settled, otherwise I think we'll go round the same loop again.

So, if people could focus on this for now: do we need detached signatures, and where? Verifier authentication is the obvious one, but say so if there's anywhere else. A concrete use case would be more useful than a general "it might be handy".

Two things from the call I'd like to see backed up. We heard both that CWT has better library support and that COSE_Sign1 does. Both can't be true, and neither came with any evidence, so if you've actually implemented either recently please say what you found @c2bo @paulbastian @GarethCOliver.

And the claim that CWT doesn't do detached signatures was raised and then partly walked back - could someone (perhaps @ve7jtb) pin down what it does and doesn't support, with a reference?

Also worth flagging that this may not be a straight either/or. RFC 9597 lets you carry CWT claims in a COSE protected header separately from the payload, and detached signatures are one of the cases it was written for. RFC 9596 adds a typ parameter to COSE. I'm not arguing for either, just noting the group should have them in view. If there are other options I've missed, please add them.

@martijnharing On COSE_Sign versus an array of COSE_Sign1/CWT, I believe this will be naturally discussed as part of #26.