Serialization Format

[GarethCOliver]

The current protocols make use of two different Serialization formats:

• OpenID4VP uses JSON
• 18013-5 uses CBOR

There is no real difference in expressiveness between these two formats. There are advantages to both of these:

• JSON is more widely used, and is human readable. As a consequence it is a bit better of a developer experience for implementation and debugging.
• CBOR has a more efficient serialization, saving ~33% overhead in size from Base64 encoding and is more suited to processing in a resource constrained environment such as a Secure Element.

Some commonly brought up considerations:

• In-person presentations, especially through NFC, are highly time and payload size sensitive
• Online presentations are less time-sensitive, but may result in cross-device flows with similar
• Due to the signing of payloads, it isn't possible for platforms to handle transformations (though libraries can help here).

The possible options are:

1. CBOR - Only

Define the protocol as CBOR CDDL only.

Pros

• Most performant
• Single format, reducing developer work and spec work

Cons

• Requires building better tooling for developers

2. JSON - Only

Define the protocol as a JSON schema only.

Pros

• Mostly widely used format
• Single format, reducing developer work and spec work

Cons

• Worse in person experience
• Makes certain Wallet architectures prohibitive

(Note: cons are probably prohibitive for this option)

3. JSON + CBOR

Define spec 'serialization agnostic' and then define matching JSON schema for online/non-size sensitive usecases) and CBOR CDDL for in-person.

Pros:

• Allows developers to work with the tools they are most familiar

Cons:

• Additional spec work, as it is not always trivial to specify in both formats (e.g. different wrapper crypto structures, canonical serialization etc)
• Additional implementation work for any base library, or party supporting both
• Risk of lack of inter-op unless some party (likely wallet) is mandated to support both

[awoie]

WG discussion:

• options perhaps oversimplified: also signing and encryption, e.g., JWT/JWE vs COSE_Encrypt needs to be covered.
• would anybody object to CBOR serialization? nobody objected on the call, and it seems like the preference of the group.
• is there anybody that really wants a JSON serialization? JSON is still better in terms of Developer Experience but multiple encoding formats also not great for DevX either; also testing efforts would proliferate if multiple options were picked.

If anybody feels strongly about JSON, please provide a comment on this issue before the next meeting.