# Label 309 — Proof of Existence on Cardano

Open, content-first, issuer-agnostic standard. Full text: /llms-full.txt

## Spec
- [Algorithm registries](/spec/algorithm-registries): The named-identifier registries for hashes, AEADs, KEMs, KDFs, and signatures — and the agility rule that makes post-quantum migration additive rather than breaking.
- [Content & hashing](/spec/content-and-hashing): How Label 309 binds a record to its content — the hashes map, what the digest commits to, and Merkle commitments for anchoring many items under one root.
- [Implementers' guide](/spec/implementers-guide): How to build a conformant Label 309 implementation — the recommended layered architecture, the cross-language byte-identical contract, and the conformance test vectors that define interoperability.
- [Introduction](/spec): What Label 309 is, the principles it guarantees, and how anyone can verify a record without trusting a server.
- [Keys](/spec/keys): The Label 309 key model — one 32-byte seed, three algorithm keypairs derived from it by domain-separated HKDF-SHA-256, and how recipient public keys are encoded and exchanged.
- [Open questions](/spec/open-questions): What is settled in the Label 309 wire format versus what is deferred or forward-looking — the confirmed cryptographic core, the candidate constructions reserved for a future revision, and the migration model for changing a constant.
- [Sealed PoE](/spec/sealed-poe): The Label 309 encryption envelope — how a sender seals content to one or more recipient keys while the chain carries only the plaintext hash and the wrapped key slots, never the plaintext and never the recipients.
- [Security model](/spec/security-model): What a Label 309 verifier trusts and what it does not — the standalone-verifiability invariant, the privacy guarantees of sealed PoE, the normative crypto rules every implementation must uphold, and the known limits of the wire format.
- [Signatures](/spec/signatures): The optional record-level `sigs` array — a detached COSE_Sign1 over the whole record body, its domain-separated signed payload, the two signer-key paths, and strict Ed25519 verification.
- [The record](/spec/the-record): The Label 309 wire format — where the record lives under metadata label 309, its map shape, canonical-CBOR rules, transport chunking, and the CDDL schema.
- [Verification](/spec/verification): The three Label 309 verifier roles, the verdict states, finality depth, and the typed error catalogue — how anyone reaches the same answer from public infrastructure alone.