I.

Content addressing solved the analogous problem for data. A URL is a pointer: it says where a thing is, not what it is. If the server moves, the URL breaks; if two servers host the same file, the URLs differ. Content addressing inverts the reference: the name is the cryptographic hash of the content itself. Two parties holding the same bytes compute the same name, regardless of where they obtained them, which database they stored them in, or what local identifier they assigned. The construction has been standard since Merkle’s authentication trees (1979); Git has named every revision this way since 2005, and IPFS (Benet, 2014) generalized it to arbitrary content.

The obstacle to applying it here is that a corporation is not bytes. It is a legal fiction – a bundle of rights and obligations created by a sovereign act – and there is no obvious byte string to hash.

II.

There is a non-obvious one. At the moment of creation, four facts are fixed: who created the corporation (the incorporator), where (the jurisdiction), under what instrument (the articles of incorporation, certificate of formation, or equivalent), and when (the filing time). Everything else – directors, shareholders, addresses, later names – is subsequent history. The four facts describe the event that brought the legal person into existence, and they have a single authoritative source: the registry that accepted the filing.

Define the genesis record as those four facts in canonical form (section III), and the identifier as an algorithm tag plus the hash of the record (section VII). Four assumptions make the definition do what is claimed of it.

One authoritative filing. The registry fixes the instrument as one byte string – the filing as accepted, which it holds and serves unchanged – and fixes the filing time with it. Two systems that record the same incorporation compute the same identifier because both hold that string, not because they consulted a naming authority. The sovereign is the source of the content; it plays no part in deriving the name. A born-digital filing meets the assumption whenever the registry keeps the bytes it accepted. A filing made on paper does not: an image of it is a rendering, remade with different bytes at each scan or certification, and until the registry fixes one string the entity has no derivable identifier (section IX).

Injectivity. Distinct incorporations yield distinct records. A formation agent may file dozens of entities in a day from one template, but the instrument states the entity’s name and the jurisdiction enforces name uniqueness at filing, so the instrument bytes differ; jurisdiction and filing time separate the rest.

A sound function. Each tagged hash function (section VII) is collision-resistant and second-preimage-resistant. The first carries the injectivity of records over to identifiers; the second is what tamper-evidence rests on. When a function loses either property, the migration of section VII is the remedy: the record is re-hashed under a sound function and the two names are bound.

A fixed genesis. The genesis is the instrument as first filed. Jurisdictions allow a defective filing to be corrected with retroactive legal effect – a Delaware certificate of correction is effective as of the original filing date (Delaware General Corporation Law, section 103(f)) – but a correction is a later event in the entity’s history (section VI), not a rewrite of the genesis. The identifier never moves.

Under these assumptions the identifier is self-certifying: anyone holding the genesis record verifies it by recomputing the hash. It is portable: it means the same thing in Delaware, Florida, and the Cayman Islands, in any system implementing the same canonical form and hash function. It is verifiable without consultation: checking that a record and an identifier match requires no query to any authority. It is tamper-evident: alter the record and the identifier no longer matches. What it does not certify is authenticity. The identifier binds a name to a claimed genesis; that the genesis corresponds to a real incorporation is exactly what a sovereign attestation supplies (section V).

III.

Hashing requires deterministic input: the same logical record must produce the same bytes on every machine. This is not a given. JSON does not fix key order. Languages disagree on number formatting. Timestamps have dozens of valid representations. If one system serializes {"creator":"alice","jurisdiction":"us-de"} and another {"jurisdiction":"us-de","creator":"alice"}, the hashes differ over identical content, and content addressing has silently become implementation addressing.

A list of house rules is not enough, because the failure modes are subtler than key order. “Sort keys lexicographically” is ambiguous: UTF-8 byte order and UTF-16 code-unit order disagree on any string containing supplementary-plane characters. The same incorporator name is different bytes in composed and decomposed Unicode – “José” hashes differently in NFC and NFD. A registry that records a date-only filing date is misrepresented by conversion to a UTC instant, which invents precision the registry never asserted.

The discipline is to adopt a complete published encoding and profile it. RFC 8785, the JSON Canonicalization Scheme, fixes member order by UTF-16 code units and number serialization by the ECMAScript rules; deterministic CBOR (RFC 8949, section 4.2) and DER (X.690) are the binary equivalents. On top of the encoding: normalize text to Unicode NFC, carry monetary amounts as integers or strings rather than floats, and preserve the registry’s own recorded precision and time scale. The instrument itself is never re-encoded: it enters the record as the byte string the registry fixed, carried opaque, and the profile governs only the fields around it. Canonicalize the representation, never the meaning.

The canonical form is part of the identifier’s definition. Two implementations produce the same identifier exactly when they hash the same profile with the same function, so the profile must be a published, versioned standard – and a profile revision changes identifiers the way a new hash function does (section VII).

IV.

The alternative is an assigned namespace, and one exists at global scale. The Legal Entity Identifier is an ISO standard (ISO 17442) endorsed by the G20 in 2012; the Global Legal Entity Identifier Foundation, established by the Financial Stability Board in 2014, oversees issuance through accredited local operating units; millions of entities hold an LEI, and regulation makes it unavoidable in wholesale finance – since January 2018 an EU investment firm cannot report a trade for a client that lacks one (MiFIR). The European Union interconnects the business registers of its member states plus Iceland, Liechtenstein, and Norway through BRIS and assigns each company an EUID, a composite of country code, register identifier, and local registration number (Directive (EU) 2017/1132; Implementing Regulation (EU) 2021/1042). Dun & Bradstreet has assigned DUNS numbers privately since the 1960s.

A global namespace for legal entities therefore requires no treaty, and sovereignty does not rule one out: the LEI went from G20 endorsement to trading mandate in six years. What an assigned namespace requires is everything else. Every identifier is an operator’s act – an entry written into the operator’s index – and resolution runs through that index: an LEI is a key into the GLEIF database, a DUNS number a key into Dun & Bradstreet’s, and an EUID resolves only through the register that issued its components – it wraps the local pointer rather than replacing it. The LEI shows what assignment costs beyond the index. An LEI is applied for, paid for, and validated against the register; it lapses unless renewed annually; entities acquire one where a mandate or a counterparty demands it; and the millions issued are fewer than the companies on the United Kingdom’s register alone.

Content addressing removes the operator, the index, and resolution through it. The identifier is a function of the genesis record: anyone holding the record derives it, nothing is applied for or renewed, nothing lapses, and nothing can be reassigned, because the identifier is not an entry in anyone’s database. What jurisdictions still must coordinate on is a one-time technical standard – the canonical form and the hash function – after which no operator runs and no authority owns the namespace. That coordination is real, and it is the whole of it.

V.

A derived identifier carries no authority, and the decentralized-identity stack does not pretend otherwise: the W3C specifications separate control of an identifier (DID Core, 2022) from claims about its subject, which are credentials signed by issuers the verifier chooses to trust (Verifiable Credentials, 2019). For a natural person there is room to argue how much bare self-assertion is worth. For an institution there is none. A corporation is who a sovereign says it is; its existence is constituted by a state act – an incorporation, a registration, a charter – and no identifier scheme changes that.

So it is the binding, not the identifier, that needs an issuer. The registry that accepted the filing signs the statement “this genesis record corresponds to entity number N in our register.” The content-addressed identifier is the stable reference the attestation points to. The jurisdiction does not control the identifier, but it alone controls the binding between the identifier and its register. Several jurisdictions attest to the same identifier independently – Delaware to the incorporation, Florida to the foreign qualification – and the result is a web of sovereign attestations rooted in one derivable name. The identifier is decentralized; the attestations are sovereign; the hash is the coordination point.

This is the standard issuer-attestation pattern with the registry in the issuer’s seat, and it already runs for legal entities in assigned form: GLEIF’s verifiable LEI, built on KERI, places issuer-signed credentials behind each LEI. Section VIII states what this note changes in that construction.

VI.

Identity includes history. Institutions issue shares, change directors, merge, dissolve, foreign-qualify, are sanctioned and unsanctioned. A genesis hash alone is a stable name with no way to verify any of that. The extension is the hash chain of linked timestamping (Haber and Stornetta, 1991): each event record carries the hash of its predecessor, so the hash of the latest event – the chain head – commits to the entire history. It is the structure a blockchain builds consensus over, used here without consensus: no proof of work, no shared ledger. The topology is one chain per attesting jurisdiction, each maintained by the system holding that jurisdiction’s authoritative record for the entity, all rooted in the same genesis identifier.

What the chain guarantees is commitment. A signed chain head is a non-repudiable commitment by its maintainer to every preceding event. Alter, insert, or delete anything after the head has been handed to an outside party, and the recomputed head no longer matches – detectable by anyone who kept the old head. When a regulator in jurisdiction A asks what happened to an entity in jurisdiction B, B’s answer can be checked against every head B ever committed to, instead of a database export whose integrity is taken on trust at query time.

What the chain does not guarantee is equally definite. Before a head has left the maintainer, history can be rewritten without trace. A maintainer can equivocate: keep two internally consistent chains from a common prefix and show different parties different heads. And no chain proves that events were recorded faithfully in the first place; it proves that what was committed has not changed since. The first two gaps close with witnesses – outside parties who countersign observed heads, as in linked timestamping (Haber and Stornetta, 1991) and KERI’s witness receipts (Smith, 2019) – which turn equivocation from undetectable into detectable on comparison. The third gap is not cryptographic at all. It is what the sovereign’s signature of section V is for.

VII.

One future requirement is definite enough to design for now. SHA-256 is inefficient inside zero-knowledge proof circuits, and proving a statement about an entity’s identity or history without revealing either – which is what privacy-preserving cross-jurisdictional compliance will demand – needs a hash designed for arithmetic circuits: Poseidon (Grassi et al., 2021), Rescue, or a successor.

This is why the identifier of section II carries an algorithm tag: a function code plus the digest, the multihash construction (Benet, 2014). The invariant is stated per tag: the same canonical genesis record under the same tag yields the same identifier everywhere. The tag buys agility, not equality – identifiers of the same record under different functions are distinct byte strings with no computable relation between them.

Migration is re-derivation plus binding. When circuits require Poseidon, the new identifier is derived from the same canonical genesis record, and the pair is bound by an event on the entity’s chain or an attestation covering both. What the tag removes is re-issuance: no authority acts and no namespace is re-allocated, because anyone holding the record derives the new name and checks the binding. A canonical-form revision (section III) is handled the same way, because it changes identifiers exactly as a new function does.

VIII.

No component here is new. Content addressing is decades old (Merkle, 1979; Git, 2005; IPFS, 2014). Hash-chained event histories are Haber and Stornetta (1991). Algorithm-tagged digests are multihash. Issuer-signed bindings are W3C Verifiable Credentials. The assembled shape – a self-addressing identifier derived from an inception event, extended by a hash-chained event log, witnessed against equivocation, bound by attested credentials – is KERI (Smith, 2019), which GLEIF’s verifiable LEI deploys in production for legal entities.

This note makes one move against that prior art: the inception content is the sovereign filing itself. A KERI identifier is derived from a key-management event; it names a controller of cryptographic keys, and the vLEI then binds the controller to an assigned LEI by credential. Deriving the identifier from the incorporation instrument instead makes the name a function of the sovereign act rather than of anyone’s keys. It exists for every entity whose filing the registry holds as a fixed byte string – no issuance, no fee, no lapse – and the registry’s attestation binds its register entry to a name any counterparty can re-derive from the filing.

IX.

Five problems remain open. Retroactive correction: the law treats a corrected filing as effective from the original date, while the chain records the correction when it happened; fixing the genesis as the instrument first filed keeps the identifier stable, but the mapping between legal effect and chain order is a convention jurisdictions would have to share. Cross-algorithm identity: after a migration an entity has two bound names, so verifiers must treat identity as the closure of attested bindings, never as byte equality. Conversion: a redomestication or statutory conversion carries a legally continuing entity into a registry that accepts a formation-class instrument for it, so a verifier meets two filings that each look like a genesis. Under the fixed-genesis convention the original filing remains the genesis, the destination’s filing is an event in the entity’s history, and the destination registry’s attestation binds its filing to the original identifier; a verifier holding only the destination filing derives a second name and learns of the first through that binding alone. The closure of attested bindings then runs across registries as well as across algorithms, which filing counts as first is a convention the two registries must share, and the destination attests a binding whose other half is another sovereign’s filing. Legacy instruments: a filing made on paper, or one the registry re-renders at each certification, has no registry-fixed byte string, so the derivation of section II has no input; the registry would have to fix one – an image or transcription certified as the instrument as filed – and that fixing is a one-time act per entity across the whole pre-digital register, which is the issuance content addressing otherwise removes. Witnessing: fork detection requires witnesses of chain growth, and who witnesses a sovereign registry – peer registries, regulators, market infrastructure – is an institutional question this note does not settle.

The trade is convenience for verifiability. An opaque UUID is easier to mint and store; a content-addressed name costs canonical serialization, deterministic hashing, and tag discipline, paid once in a standard. It buys the reference that software operating across borders needs – a program forming a Cayman subsidiary for a Delaware parent refers to the parent in a way any counterparty verifies without querying Delaware – and no outage, lapse, or reassignment can break it.

Creation and identification are different acts. A jurisdiction creates a corporation; that is sovereignty, and nothing here touches it. Identifying the corporation – distinguishing it from every other entity in every system that refers to it – is a computation on the record of the sovereign act, and needs no authority. Authenticating it needs exactly one: the sovereign whose act it was. The identifier distinguishes without any authority; it authenticates only with one.