SHA-256 collision for a 48-bit MSB truncation
The requested collision was found and locally verified. The delivered
collision.json contains exactly the four requested fields.
Inputs beginning with 0x represent decoded hexadecimal bytes, not the literal
characters of the hexadecimal string.
Observed evidence
| Value | Input A | Input B |
|---|
| Input bytes (hex) | 494d44430092d146 | 494d4443018a8ace |
| Full SHA-256 | e6638acfbfe4a235ee4f74ee9a68128e8c0e00f8e64558fd467cca4fd788e0f4 | e6638acfbfe458abbeb5432450696d62aadcaa2ede695e43ef2e3f585d6b7150 |
| First six bytes (48 MSB bits) | e6638acfbfe4 | e6638acfbfe4 |
The inputs are distinct, and their first 48 digest bits match. Their full
digests differ. Here lambda is 24, so the requested truncation is 2 × 24 = 48 bits.
The search hashed eight-byte inputs consisting of ASCII IMDC followed by a
four-byte unsigned counter in big-endian order. It compared the first six digest
bytes using a hash table. Counters 9,621,830 and 25,856,718 produced the match;
the sequential search made 25,856,719 evaluations including counter zero.
Evidence is attributable to local computation: the search used the system
OpenSSL library, and verification used Python hashlib and the OpenSSL 3.0.13
command-line tool. Both verification paths produced the full digests above.
Python's underlying hashing provider may also be OpenSSL, so these checks are
not claimed to be independent implementations or an independent review.
Reproduction and limits
Run python3 verify.py from the repository. The delivered
verification script uses only the Python standard library,
checks the exact JSON field set and parameter values, decodes the inputs,
checks that they differ, and recomputes both digests and their six-byte prefixes.
The local run exited successfully with:
Shared first 48 bits: e6638acfbfe4
PASS: distinct inputs and identical 48-bit MSB prefixes
The additional local command openssl dgst -sha256 on the decoded binary
inputs returned the same full digests. Scratch search files are excluded from
delivery; the collision and its verification do not depend on them.
This is a collision for the specified truncation only. No full SHA-256 collision
is asserted. No external SIMD verifier was available during this task, so its
acceptance remains unobserved; the reported success is a local check, not an
external certification. There are no unresolved questions about the locally
computed input bytes or prefix equality.