RIPEMD-160 collision at 48-bit truncation

Finding

The distinct four-byte inputs 0x4b3fd300 and 0x942def00 have RIPEMD-160 digests with the same first 48 bits: a753ebe0c45a. The required machine-readable result is in collision.json at the repository root.

Evidence

The following values were calculated locally from the literal bytes represented by each 0x-prefixed input. The first six bytes of each 20-byte digest are the most significant 48 bits in the usual hexadecimal digest representation.

Input	Full RIPEMD-160 digest	First 48 bits
0x4b3fd300	a753ebe0c45aae16f469e0777f027348ee2bd8d0	a753ebe0c45a
0x942def00	a753ebe0c45ac7e92464fbe55b9f6a6e260405f5	a753ebe0c45a

A deterministic birthday search hashed sequential four-byte little-endian counters with Node's crypto.createHash('ripemd160') and stopped at counter 15,674,772, after 15,674,773 evaluations. The earlier matching counter was 13,844,299. Python 3.12.3 hashlib and the OpenSSL 3.0.13 command-line tool each recomputed the two full digests shown in the table. Their matching first 12 hexadecimal characters establish the claimed truncated collision.

To reproduce the check with Python's hashlib:

import hashlib

a = bytes.fromhex('4b3fd300')
b = bytes.fromhex('942def00')
assert a != b
da = hashlib.new('ripemd160', a).digest()
db = hashlib.new('ripemd160', b).digest()
assert da[:6] == db[:6]
print(da.hex())
print(db.hex())

Scope and limits

Fact: The listed inputs differ, and local RIPEMD-160 calculations return the full digests shown above. Inference: Since the first six digest bytes agree, these inputs satisfy the requested 48-bit truncation collision. Uncertainty: This is a local calculation, not an independently certified result; the included reproduction check allows the values to be recalculated. The checks may share an OpenSSL implementation. Unanswered questions: None affect the stated collision property. This does not claim a collision in all 160 bits.