Producing and enforcing deterministically encoded CBOR

[casey]

I'm working on an application which relies on stable hashes of encoded CBOR objects. To facilitate this, I'd like to both produce and require deterministically encoded CBOR[0], specified in RFC 8949.

When encoding, I'd like to produce deterministically encoded CBOR, e.g., integer types should be as small as possible, map keys should be sorted, etcetera. Sorting map keys could be expensive, so I'd be fine with opting-into an assert if I try to serialize maps in the wrong order, and it's on me to avoid it.

When decoding, I'd like to error on non-deterministically encoded CBOR.

This would certainly be an opt-in feature, since I don't think it's something that most people need or want. It would probably also only make sense for minicbor_derive and/or minicbor_serde, or at least be most easy to implement for them.

I'm hoping to be able to use minicbor_derive, since I like using small integer keys.

[0] This differs from RFC 7049 which uses the term "canonical CBOR". The major difference is that in canonical CBOR, shorter map keys sort before longer map keys, regardless of their byte value.

[casey]

I think the things that aren't currently guaranteed to produce deterministic CBOR are:

• f16, f32 and f64
• HashMap and BTreeMap

Making floats produce determnistic CBOR is relatively non-invasive, you convert to the next size down and see if it's lossless.

For HashMap and BTreeMap, you have to encode keys to CBOR to a temporary buffer, sort the keys, and then emit the sorted items. Storing to a temporary buffer is overhead that isn't acceptable for any application that doesn't need deterministic CBOR, so it should be opt-in.

One possibility is a minicbor::sorted_map codec for map fields, for use with #[cbor(with = "minicbor::sorted_map")] which sorts the keys before emitting them.

The following types serialize to lists:

• HashSet, BTreeSet, and BinaryHeap

And lists don't technically have ordering requirements. However, it might be nice to provide a minicbor::sorted_set codec for such fields.

On the decoding side, I think the easiest fix would be some kind of attribute which enforces determnistic CBOR when decoding #[cbor(require_deterministic)], and applies recursively to the type itself, as well as any sub-values.

[twittner]

Thank you for submitting this request and my apologies for replying late. I think this can be done, but it might take a while before I get around to it.