Keccak-256 collision, λ = 24

A collision for the first 48 bits was found and verified locally on 2026-10-05. The deliverable is collision.json, with exactly the four requested fields:

{"algo":"keccak256","lambda":24,"inputA":"0x8375360100000000","inputB":"0x7131040200000000"}

Observed evidence

Both inputs are distinct eight-byte sequences decoded from hex. The separately authored XKCP reference implementation produced these full digests:

Input	Keccak-256 digest
0x8375360100000000	8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868
0x7131040200000000	8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1

The first six bytes (the leftmost 12 hexadecimal digits, or 48 MSB bits) of both digests are 8851a59bbb9d. The full digests differ.

verification.json records the computed values and source checksum. src/verify.py checks the exact JSON fields, algorithm, integer lambda, decoded-input distinctness, and six-byte prefix equality. It also passed two legacy Keccak regression vectors and five SHA3 cross-checks against Python's hashlib, using the SHA3 suffix only for those cross-checks. Verification can be repeated without network access:

python3 src/verify.py

Method and attribution

src/search.c enumerated eight-byte little-endian counters starting at zero. It computed Keccak-256 prefixes in parallel batches of 65,536 and inserted results in counter order into a hash table. Counters 20,346,243 and 33,829,233 matched. Including the rest of the final computed batch, 33,882,112 hashes were evaluated; 33,829,234 were examined for matches. The local run took approximately 34 seconds, as recorded in search.log. These counts and timing describe this run, not a guarantee for other machines or input sequences.

The permutation and padding follow the Keccak team's specification summary. Verification uses its readable and compact XKCP implementation at revision ed74f214, vendored unchanged with its attribution and CC0 notice. The generic sponge is configured with rate 1088, capacity 512, a 32-byte output, and suffix 0x01 (legacy Keccak, no appended domain bits). SHA3-256 instead uses suffix 0x06. These parameters and the suffix distinction are documented in that reference source. The local source checksum is recorded in vendor/README.md.

Conclusion and limits

The observed digest equality satisfies the requested 48-bit collision condition under hex-to-bytes decoding. This is a truncated collision, not a collision of the full 256-bit digest. The birthday-search rationale is a heuristic; the reported pair is supported by direct recomputation rather than that heuristic.

These are local checks using a separate implementation, not independent review. The external SIMD verifier was not available or run here, so its eventual acceptance remains unobserved. No other unresolved local verification issue was identified.