CBOR Web Token (CWT) Claims in COSE Headers
Extracted elements (15)
Directly including CWT claim values as COSE header parameter values was not feasible because of conflicts between numeric COSE header parameter assignments and numeric CWT claim assignments. A single wrapping header parameter (label 15) was introduced to avoid this collision.
This specification corrects an omission relative to JWT/JOSE: RFC 7519 Section 5.3 defined a mechanism for including JWT claims as JOSE header parameters (e.g., to make issuer visible in encrypted JWTs), but no equivalent was standardized for CWT/COSE until this document.
The CWT Claims header parameter MAY be used in any COSE object that uses header parameters, such as COSE_Sign objects; its use is not restricted to CWTs, enabling use with non-CBOR payloads such as bitmap images.
It is RECOMMENDED that the CWT Claims header parameter only be used in a protected header to avoid the contents being malleable.
Recipients of the CWT Claims header parameter MUST NOT use the information in it beyond the integrity protection or authentication afforded to the CWT Claims header and the information used to derive its intended interpretation.
The CWT Claims header parameter MUST only occur once in either the protected or unprotected header of a COSE structure.
The information needed to determine the intended interpretation of the CWT Claims header parameter MAY come from other header parameters; use of the 'typ' header parameter (RFC 9596) is RECOMMENDED as the way to convey this information at an appropriate integrity protection level.
When CWT claims are present in both the payload and the header of a CWT, the receiving application MUST verify that their values are identical, unless the application defines other specific processing rules for those claims.
CWT claims in COSE headers are not encrypted, so when privacy-sensitive claims are present, applications and protocols must ensure COSE objects are only visible to parties authorized to access that sensitive information.
The CWT Claims COSE header parameter is defined with label 15, value type map, and map keys constrained to the IANA CWT Claims registry. It provides a standard location for CWT claims within any COSE header.
IANA has registered the new COSE header parameter 'CWT Claims' (label 15, value type map) in the 'COSE Header Parameters' registry, with map keys constrained by the IANA CWT Claims registry.
For detached COSE payloads, it is the responsibility of the application to ensure the payload is transported without changes, as described in RFC 9052.
Processing information in claims prior to cryptographic validation poses security risks. Implementers must ensure any tentative decisions made on unverified claims are confirmed once cryptographic processing completes, including information used to derive the intended interpretation of the CWT claims parameter.
When CWT claims appear in both the payload and the header, applications must verify they are identical to eliminate potential confusion from differing values for the same claim, which could result in inconsistent processing.
The CWT Claims header parameter value is encoded as a CBOR map where keys (Claim-Label) are integers or text strings, matching the IANA CWT Claims registry. CDDL: CWT-Claims = { * Claim-Label => any }, Claim-Label = int / text.