Messages, structures and headers¶

What RFC 9052 defines above the CBOR: the six message types, the structures a signature, a MAC or an encryption is computed over, and the rules that decide what a header says.

Cryptographic structures — what a signature, a MAC or an encryption actually covers
Reading headers — the RFC 9052 rules a raw map lookup does not apply
Common header parameters — every label the library reads, with its accessor
Detached content — a payload that travels outside the message
External additional authenticated data — data bound to the message without travelling in it

COSE tags¶

COSE defines six message types, each a CBOR tag. The classes come from spomky-labs/cbor-php 3.4.0 or later; the Cose\...Tag classes this library used to ship are deprecated, see Upgrading.

Tag	Value	Class (cbor-php 3.4.0+)	Description
COSE_Encrypt0	16	`CBOR\Tag\CoseEncrypt0Tag`	Single recipient encrypted message
COSE_Mac0	17	`CBOR\Tag\CoseMac0Tag`	MAC without recipients
COSE_Sign1	18	`CBOR\Tag\CoseSign1Tag`	Single signature structure
CWT	61	`CBOR\Tag\CwtTag`	CBOR Web Token (RFC 8392)
COSE_Encrypt	96	`CBOR\Tag\CoseEncryptTag`	Multiple recipients encrypted message
COSE_Mac	97	`CBOR\Tag\CoseMacTag`	MAC with recipients
COSE_Sign	98	`CBOR\Tag\CoseSignTag`	Multiple signatures structure

All seven are registered in the default decoder, so Decoder::create() resolves them without any TagManager configuration:

use CBOR\Decoder;
use CBOR\StringStream;
use CBOR\Tag\CoseSign1Tag;

$message = Decoder::create()->decode(new StringStream($encodedData));
if (! $message instanceof CoseSign1Tag) {
    throw new RuntimeException('Not a COSE_Sign1 message');
}