COSE
Also called CBOR Object Signing and Encryption, RFC 9052
COSE does for CBOR-encoded data exactly what JWS does for JSON-encoded data: it defines a standard way to attach a cryptographic signature (or encrypt, or MAC) a piece of binary-encoded data, so two independent implementations can produce and verify the same structure without guessing at each other's conventions. Where JWS assumes JSON and base64url text encoding throughout, COSE assumes CBOR (see that entry), a compact binary format, end to end, including the signature structure itself.
The practical reason COSE exists rather than everyone just using JWS: JSON's text-based encoding (field names as strings, base64url-encoded binary blobs) is comparatively heavy for constrained environments, a smart card, a Bluetooth Low Energy exchange, an offline scan at an airport gate. CBOR is designed specifically to be compact and fast to parse in exactly those settings, and COSE is what lets a signature travel in that same compact binary form rather than forcing a detour through JSON.
The credential world's concrete use of this: ISO/IEC 18013-5's mdoc format (see that entry) secures its data with two COSE structures, IssuerAuth, the issuer's signature over the Mobile Security Object, and DeviceAuth, the holder device's proof of possession at presentation time. Anywhere an mdoc or mobile driving licence is verified, COSE is the signature envelope underneath it.
Where it comes from
RFC 9052 (which obsoletes the earlier RFC 8152), from the IETF COSE working group, with Jim Schaad as primary editor. Solidus has no editorial role in it.
Solidus status
Not built. A direct grep across every TypeScript and Rust source file in the Solidus monorepo for cose/COSE returns zero matches anywhere in a credential-issuance, presentation, or verification path. Every credential format Solidus actually ships, SD-JWT VC and the documented (but not live) Data Integrity/Linked Data Signature shape, is JSON/JWT-family, secured by JWS, not COSE.
This isn't an isolated gap: it's the direct consequence of not having mdoc support at all (see the mDoc entry). Since mdoc's IssuerAuth and DeviceAuth are both COSE structures by definition, the mdoc gap and the COSE gap are the same missing piece of engineering work, described from two different angles rather than two things to separately close.
Check it yourself: there's nothing of Solidus's to run, so this entry doesn't invent a demo. The check a stranger can run is the negative one, pull any published @solidus-network package and grep its source for cose or COSE. Nothing appears.
Where it comes from
Someone else specified this. Solidus assembles it.
RFC 9052 (obsoleting the earlier RFC 8152), from the IETF COSE working group, with Jim Schaad as primary editor. COSE is CBOR's counterpart to JOSE/JWS, the same signing-envelope idea, built for the binary CBOR encoding instead of JSON. ISO/IEC 18013-5's mdoc format uses COSE structures for both IssuerAuth and DeviceAuth (see the mDoc entry). Solidus has no editorial role in the spec and, confirmed by direct grep across the codebase, no shipped implementation of it anywhere.
How to check this
Solidus has not built this. The entry explains the concept.
None to run. There is nothing of Solidus's to inspect. The check a stranger can run themselves is the negative one: grep any published @solidus-network package's source (or the credential-issuance path in the public repos) for "cose" or "COSE", nothing matches.