Keccak-256 truncated collision, λ = 24

The two distinct eight-byte inputs in ../collision.json have identical first 48 bits (six bytes, MSB prefix) of their Keccak-256 digests. The 0x strings encode raw bytes, not the UTF-8 text of the hexadecimal strings.

Field	Value
inputA	0x8375360100000000
inputB	0x7131040200000000
Keccak-256(inputA)	8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868
Keccak-256(inputB)	8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1
Shared 48-bit prefix	8851a59bbb9d

Evidence and reproduction

These are locally computed facts. find_collision.py searched eight-byte little-endian encodings of consecutive integers starting at zero, using system OpenSSL EVP_Q_digest with KECCAK-256. It found indices 20,346,243 and 33,829,233 after 33,829,234 evaluations, in approximately 54.35 seconds on this host. The elapsed time describes this run only.

verify_collision.py independently implements Keccak-256 in pure Python, with the Keccak 0x01 domain padding, and needs only Python's standard library. Run from the repository root:

python3 artifacts/verify_collision.py

Observed result:

inputA: 8375360100000000
digestA: 8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868
inputB: 7131040200000000
digestB: 8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1
PASS: distinct inputs; matching first 48 bits: 8851a59bbb9d

The verifier also checks the JSON keys, algorithm, λ, distinct decoded inputs, and empty-message and abc digest vectors. Additional local checks compared the two implementations for message lengths 0, 1, 8, 32, 135, 136, 137, 272, and 1000 bytes; all agreed, including absorption/padding boundaries.

Interpretation and limits

Matching six-byte prefixes establishes the requested truncated collision. The full 256-bit digests differ. No statistical estimate is needed to establish the result, and no claim of a full Keccak-256 collision is made.

All verification described here was performed locally by the producing agent. It is reproducible evidence, not an external audit. The SIMD acceptance check has not been run here; its outcome remains unobserved. No other unanswered question is required to assess the supplied byte pair locally.