Keccak-256 collision truncated to 48 bits
Result — locally verified fact
The distinct inputs in collision.json collide in the first 48 bits (six bytes, or 12 leading hexadecimal digits) of Keccak-256, satisfying lambda = 24.
| Field | Value |
|---|
| inputA (hex-encoded bytes) | 0x8375360100000000 |
| inputB (hex-encoded bytes) | 0x7131040200000000 |
| Keccak-256(inputA) | 8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868 |
| Keccak-256(inputB) | 8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1 |
| Shared 48-bit MSB prefix | 8851a59bbb9d |
The inputs each decode to eight bytes. The 0x marker and hexadecimal characters are not hashed as text. Their full 256-bit digests differ.
Method and attributable evidence
A deterministic birthday search enumerated eight-byte little-endian counters from zero. tools/search.js used the vendored js-sha3 v0.9.3 implementation, recording the first four digest bytes in a hash table and checking the next two bytes on candidate matches. It found this pair after 33,829,234 distinct candidates in 288.823 seconds. This count excludes extra hash evaluations used to recheck table matches. The actual search output is preserved in search-result.json.
A separate implementation recomputed both full digests: Gilles Van Assche's XKCP CompactFIPS202.py, called as Keccak(1088, 512, input, 0x01, 32). The generic sponge function supports this legacy Keccak suffix. The Keccak team's specification summary describes the permutation, padding, and suffix conventions; SHA3-256 instead uses suffix 0x06. The code used here is included unchanged under tools/vendor/, with source URLs, licenses, and SHA-256 file checksums in its README.
Run the independent implementation check offline from the repository root:
python3 tools/verify.py
The command exited successfully. Its output is preserved in verification.json. It checks the exact JSON field set, algorithm, lambda, input decoding, distinct input bytes, and equality of the first six digest bytes. It also passes known-answer checks for empty input and abc. Negative checks rejected a noncollision, identical inputs, an extra JSON field, malformed hexadecimal input, and a wrong algorithm identifier.
Interpretation and limits
The matching prefix is an observed computation, not a probability estimate or a fabricated candidate. Agreement between two different implementations provides local evidence for the requested collision. No claim is made of a full Keccak-256 collision.
The external SIMD verifier was not available or run in this session; its acceptance remains unobserved. These recorded checks have no independent reviewer authority. All implementation dependencies needed for offline reproduction are ordinary included source files; Python 3 is required for verification, and Node.js for repeating the search.