Selective Disclosure CBOR Web Tokens (SD-CWT)#

M. Prorock, O. Steele, H. Birkholz, R. Mahy, M. Jones — SPICE WG document

• Why: The CBOR/COSE twin of SD-JWT: selective disclosure for constrained devices and CBOR-native credential ecosystems. Watching it mature tells you where the JSON and CBOR credential formats will converge or diverge.
• What: A data-minimization technique for CBOR Web Tokens, inspired by SD-JWT but realigned with COSE and CWT structure; at -05 with no major normative changes in the last cycle.
• How: Recent tightening: AEAD guidance (no authentication tags under 16 bytes), corrected COSE key examples, explicit rules for verifier handling of unknown claims, sorted CBOR map keys for test vectors. Open issues are CBOR-specific hygiene: encoding restrictions (forbid indeterminate length, max nesting depth 16, bstr-encoded map keys), tagged map keys, decoy-digest examples — two issues gated on early IANA registration. About 2.5 implementations (Rust, JavaScript, Python) heading into interop testing.
• Where applicable: Constrained-device and COSE-based credential ecosystems; WG document in the interop phase — steady, unglamorous, on track.