Keccak-256 collision, truncated to 48 bits

Result

collision.json contains two distinct eight-byte inputs, encoded as hex (the 0x prefix indicates decoded bytes, not literal UTF-8 text):

Field	Value
inputA	0xee62600000000000
inputB	0xbef60b0300000000
lambda	24
Shared first 48 bits, MSB	3fc82665f648

Full Keccak-256 digests recomputed locally:

A: 3fc82665f6489d151e686056b06d4966bc39914f8bc4e080721ca720701f4c11
B: 3fc82665f64840951a2d3e46bf6111e71264921338aa56445f74313272f8708a

The first six digest bytes match exactly. The full digests differ; the result is a collision only under the requested 48-bit truncation.

Method and attributable evidence

The local C search in tools/search.c enumerated eight-byte little-endian counters, computed original Keccak-256, sorted the six-byte prefixes, and selected adjacent equal prefixes. A search of 33,554,432 inputs found no match. The expanded search of 67,108,864 inputs found the reported pair. These counts overlap: the second search includes the first range.

Keccak-256 uses a 1088-bit rate, 512-bit capacity and original Keccak padding with delimited suffix 0x01. The Keccak team's specification summary describes the permutation, sponge construction and suffix encoding; no trailing domain bits implies suffix 1. SHA3-256 instead has suffix 0x06, so substituting SHA3-256 would answer a different question.

Verification used Gilles Van Assche's XKCP compact Python implementation, vendored unchanged at tools/CompactFIPS202.py, with its CC0 notice preserved. Its SHA-256 file checksum is:

0b731097a4dfcf33fdaf395ac0bee81c6a6ebff2975590c35ad8cd8d6f3c204f

tools/verify.py calls Keccak(1088, 512, inputBytes, 0x01, 32). It checks the JSON field set and parameters, decodes the inputs, checks byte inequality, and asserts equality of the first six output bytes. It also checks the empty-string and abc Keccak-256 vectors and cross-checks the underlying implementation in SHA3 mode against Python's hashlib.sha3_256 on four messages, including messages spanning a rate block.

Executed locally with exit code 0:

python3 tools/verify.py

The output is recorded in artifacts/verification.json, including both full digests and verified: true. The verifier requires only Python 3 and the delivered source, with no network or external package dependencies.

Search reproduction (GCC and OpenMP required):

mkdir -p test/scratch
gcc -O3 -march=native -fopenmp tools/search.c -o test/scratch/search
OMP_NUM_THREADS=16 test/scratch/search 67108864

Interpretation and limits

Observed facts: the delivered inputs are distinct and the vendored implementation recomputed matching first-six-byte prefixes. Thus the local evidence supports the requested collision. No probabilistic assumption is needed to check this concrete pair.

The checks were performed by this task's agent using a separate implementation from the search code. They are reproducible local evidence, not independent reviewer certification. The external SIMD verifier was not available or run in this session, so its acceptance remains unobserved. No full 256-bit collision or broader cryptographic weakness is claimed.