Message types are tagged CBOR arrays: COSE_Sign1 (tag 18) with protected header, unprotected header, payload and one signature; COSE_Sign (98), COSE_Mac0 (17) and COSE_Encrypt0 (16), among others. The signature covers a Sig_structure that includes the context string Signature1, the protected header bytes, external additional data and the payload. ECDSA signatures are raw r‖s, as in JOSE.
Algorithms are integers: −7 ES256, −35 ES384, −36 ES512, −8 EdDSA, −19 Ed25519 and −53 Ed448 (RFC 9864), −257 RS256 (RFC 8812) and −37 PS256 (RFC 8230). Keys are COSE_Key maps: kty 2 (EC2) with crv 1 for P-256, or kty 1 (OKP) with crv 6 for Ed25519. RFC 9052 and RFC 9053 replaced RFC 8152 in 2022.
WebAuthn public keys and attestation statements, ISO mdoc mobile security objects, CWTs and C2PA manifests are all COSE; the COSE/CWT decoder shows the structure of any of them.