Keccak-256 truncated collision (λ = 24)
The requested collision is supplied in collision.json. Hex strings represent decoded bytes, not the UTF-8 bytes of the hexadecimal text.
| Field | Observed value |
|---|
| inputA | 0x8375360100000000 |
| inputB | 0x7131040200000000 |
| Keccak-256(inputA) | 8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868 |
| Keccak-256(inputB) | 8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1 |
| Shared first 48 bits (MSB of the serialized digest) | 8851a59bbb9d |
Method and attributable evidence
The locally authored src/collision.c enumerated eight-byte little-endian integers starting at zero and stored the first six digest bytes in a hash table. It found counters 20,346,243 and 33,829,233, after 33,829,234 total evaluations. This implementation uses Keccak-f[1600] with 24 rounds, a 136-byte rate, and original Keccak padding with delimiter 0x01. The permutation and sponge construction are documented by the designers in the Keccak specifications summary and Keccak reference, version 3.0. The task's λ = 24 determines a 48-bit comparison; the permutation's 24 rounds are a separate parameter.
The separately authored src/verify.py implements a generic Python sponge with explicit two-dimensional lane mapping. It uses only the Python standard library, checks empty-message and abc known-answer values, validates the JSON key set and parameters, decodes the inputs, checks their distinctness, and recomputes both complete digests. Its local output was:
digestA: 8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868
digestB: 8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1
PASS: distinct inputs; identical first 48 bits: 8851a59bbb9d
The C program's full digests matched this output byte for byte. It compiled with gcc -O3 -march=native -Wall -Wextra without warnings.
Conclusion and limits
Observed facts: the decoded inputs are distinct, and both local implementations produced the full digests above with identical first six bytes. These checks support the conclusion that the supplied pair meets the requested 48-bit collision condition. The full 256-bit digests differ.
The evidence is attributable to the included source and this local execution. The two implementations were authored in this assignment; their agreement is not independent external review. SIMD verification was not available or run here, so its acceptance remains unobserved. No claim is made that path or byte validation certifies cryptographic behavior.