Keccak-256 collision in the first 48 bits (λ = 24)

Result: a locally verified collision was found. The required four-field object is in ../collision.json. Inputs are hex-encoded byte strings, not the UTF-8 characters of their hex representations.

Value	Input A	Input B
Input bytes (hex)	8375360100000000	7131040200000000
Keccak-256 digest	8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868	8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1
First 48 bits	8851a59bbb9d	8851a59bbb9d

The inputs differ, while the first six digest bytes agree. The full 256-bit digests differ; the claim is exclusively a collision under 48-bit MSB truncation.

Method and attributable evidence

The local C birthday search (source) enumerated eight-byte little-endian integer encodings starting at zero. An open-addressed table stored six-byte digest prefixes and their input counters. It found counters 20,346,243 and 33,829,233 after 33,829,234 evaluations, including counter zero. These counts are recorded in the search log.

The search uses Keccak-f[1600] with 24 rounds, a 1088-bit rate, 512-bit capacity and original Keccak padding. The algorithm background is the Keccak team's reference specification and specifications summary. The verifier calls the generic sponge with delimited suffix 0x01, producing original Keccak-256 rather than SHA3-256.

Verification uses the independently authored Keccak Team implementation from XKCP, vendored unchanged in tools/keccak-reference.c, retaining its attribution and public-domain dedication. Its SHA-256 file checksum is 7d25b518f28b4b9be141495dde205621fdb528e880596ef9507d30ba1b937dc9. The downloaded file was compared byte-for-byte with that pinned revision.

The offline verification script checks exact JSON keys, algorithm, integer λ, distinct decoded inputs, full digests and matching first 12 hex digits. It also checks the reference implementation against Keccak-256 known-answer values for the empty message and abc. Its recorded output is verification.json.

Reproduce from the repository root with Python 3 and a C compiler:

python3 tools/verify.py

No network, package installation or external library is needed. The C reference is compiled into a temporary directory during verification. The search itself need not be rerun to validate the collision.

Findings and limits

Observed facts: local search and separate reference recomputation produced the digests above; the schema, distinctness and prefix checks passed. Inference: this satisfies the specified mathematical collision condition under the stated hex decoding and first-six-byte interpretation. Unverified: the external SIMD evaluator was not available in this session, so its acceptance is not claimed. These are local checks using a separate implementation, not an independent review or certification. No cryptographic conclusion beyond this truncated collision is asserted.

The supplied previous-attempt failure was a model-capacity runtime error and supplied no surviving candidate or code. This deliverable was generated and checked afresh.