CBOR Web Token (CWT)

Note

IETF specification defining the CBOR Web Token (CWT), a compact means of representing claims in CBOR, protected by COSE, derived from the JWT.

Summary

Purpose

IETF RFC 8392 (May 2018) defines the CBOR Web Token (CWT):

The claims are encoded in CBOR, a compact binary format, and protected by COSE, the signing and encryption mechanism for CBOR objects. The CWT is derived from the JWT, but uses CBOR instead of JSON RFC 8392, Abstract.

Who it applies to

The RFC itself imposes nothing under eIDAS. It comes into play through Implementing Regulation 2025/848, on the registration of wallet-relying parties.

• Member States implement wallet-relying party registration certificates in accordance with Annex V to that regulation Art. 8(2)(e). They authorise at least one certificate authority to issue these certificates Art. 8(1).
• A registration certificate describes the intended use of the relying party and the attributes it has registered to intend to request from users Art. 2(15).

Key points

• Two signed formats. Annex V provides that the data exchange format of the registration certificate is signed JSON Web Tokens (RFC 7519) and CBOR Web Tokens (RFC 8392) Annex V.
• A token close to the JWT. The CWT takes over the claims of the JWT; it targets uses where JSON is considered inefficient, for example certain low-power connected devices RFC 8392, § 1. Introduction.
• Short keys. To keep tokens as small as possible, claim names are represented by integers or text strings RFC 8392, § 3. Claims.
• Content left to applications. The set of claims that a CWT must contain depends on the context and is outside the scope of the RFC RFC 8392, § 3. Claims.
• Optional CWT tag. The RFC defines a CBOR tag that makes it possible to indicate that a structure is a CWT; its use is optional RFC 8392, § 6. CWT CBOR Tag.
• Another mention of the format. Annex II to Implementing Regulation 2024/2979 requires an MSO (mobile security object) revocation list to be implemented as a status list token in CWT format, without citing RFC 8392 Annex II.

Clauses referred to by the act

• Annex V to Implementing Regulation 2025/848 refers to the RFC as a whole, without a clause number Annex V.

Links

• Act that refers to it: Implementing Regulation 2025/848 Implementing Regulation (EU) 2025/848 — consolidated version of 11/08/2026.
• Related standards: RFC 7519, JWT RFC 7519; RFC 8949, CBOR RFC 8949; Token Status List, an IETF draft draft-ietf-oauth-status-list-20.
• Learning path: step 3, the European wallet.

Written by Asphalia.