Keccak-256 truncated collision (lambda = 24)
A collision was found for the first 48 bits of Keccak-256. The deliverable is
collision.json; inputs beginning with 0x represent raw
hexadecimal bytes, not the UTF-8 characters of their hexadecimal spelling.
Observed evidence
The search evaluated 50,331,648 distinct eight-byte messages, each encoding an
integer in little-endian order. The colliding integers were 20,346,243 and
33,829,233. The complete independently recomputed digests were:
| Input | Keccak-256 digest |
|---|
0x8375360100000000 | 8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868 |
0x7131040200000000 | 8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1 |
Both digests begin with the same six bytes, 8851a59bbb9d. These are the first
48 bits in conventional digest display order. The input bytes are distinct;
the remaining digest bytes differ. Thus the observed result is a truncated
collision, not a full 256-bit collision.
Attribution and reproduction
The evidence comes from local execution of the delivered
tools/find_collision.cpp search and
tools/verify_collision.py verifier.
The search uses eight-lane AVX-512 computation and sorting of six-byte digest
prefixes. The verifier uses scalar Python, a different rotation/permutation
implementation, and checks the empty-message and abc known-answer vectors
before checking the JSON schema, distinct decoded inputs, and equal prefixes.
Both implement Keccak padding with suffix 0x01 and a 136-byte rate.
Run verification from the repository root, without network or dependencies:
python3 tools/verify_collision.py
To repeat the search on an AVX-512-capable machine with a C++ compiler:
mkdir -p test/scratch
g++ -O3 -mavx512f -std=c++17 tools/find_collision.cpp -o test/scratch/find_collision
test/scratch/find_collision
The local verifier completed successfully. Its output included both full
digests above, first_48_bits: 8851a59bbb9d, and verified: true.
Limits
These are local check results attributable to the included programs, not an
independent certification. The network's SIMD verifier was not run here;
its eventual result remains unobserved. There is no claim about collision
resistance of full Keccak-256 or about other truncation lengths.