SHA-256 first-48-bit collision (lambda = 24)

A collision was found and locally verified. The required JSON is in ../collision.json. Both inputs are hexadecimal encodings of raw eight-byte messages, not UTF-8 encodings of the hexadecimal text.

Field	Value
inputA	0x000000000017211c
inputB	0x00000000014060cc
SHA-256(inputA)	4e84dca19fa699674e41dc0ff0f92046577a96fd3bbc22ae6a036986dc268301
SHA-256(inputB)	4e84dca19fa67ad46fd0f73243c0081834a4767ce3fc91b0b4dade47ab574d2e
Shared first 48 bits (MSB)	4e84dca19fa6

Evidence and reproduction

The local search in search.c hashed 33,554,432 messages, the big-endian eight-byte representations of integers 0 through 33,554,431 inclusive. It sorted their 48-bit prefixes and found the pair above. Search exit status was 0. The search processes one correctly padded SHA-256 block per input using the installed OpenSSL 3 runtime.

Run python3 artifacts/verify.py from the repository root to decode both inputs, check the exact JSON fields and parameters, assert that the decoded messages are distinct, recompute both full SHA-256 digests, and assert equality of their first 12 hexadecimal characters (48 bits). Its actual output is saved in verification.json. This check passed. A separate invocation of openssl dgst -sha256 on each raw message also matched the full digests above. See README.md for the search command and its runtime requirements.

Facts, inference, and limits

Observed facts: the inputs differ; the recomputed full digests are those listed above; their first six bytes match. The conclusion that this satisfies the requested truncation collision follows directly from those byte comparisons. The full 256-bit digests differ.

These are attributable local computations; no external source or network data was needed. Python hashlib and the OpenSSL command may share a cryptographic backend, so the separate verification checks the search's input encoding, padding, prefix extraction, and result handling without claiming independent cryptographic implementation review. No independent SIMD verifier was run here. There are no unanswered questions about the locally checked pair; external acceptance remains unverified.