Keccak-256 collision in the first 48 bits
The distinct eight-byte inputs in collision.json produce the same first six digest bytes, 8851a59bbb9d, in local verification. This satisfies the requested 48-bit truncation for lambda = 24.
| Field | Value |
|---|
| inputA (hexadecimal bytes) | 0x8375360100000000 |
| inputB (hexadecimal bytes) | 0x7131040200000000 |
| Full Keccak-256 digest A | 8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868 |
| Full Keccak-256 digest B | 8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1 |
| Shared leading 48 bits | 8851a59bbb9d |
The 0x values encode raw bytes; the literal hexadecimal text is not hashed. The complete 256-bit digests differ.
Method and attributable evidence
The C search enumerated eight-byte little-endian counters starting at zero and used a hash table to detect repeated six-byte digest prefixes. It found the pair after 33,829,234 evaluations, as recorded in search.log.
The separate Python verifier recomputed the full digests using a matrix representation and generated round constants. It also checked known-answer digests for the empty string and abc, the exact JSON field set, algorithm and lambda, distinct decoded inputs, and equality of the first six digest bytes. All checks passed; verification.txt contains the observed output.
The implementations use Keccak-f[1600], 24 rounds, a 136-byte rate, and original Keccak padding with delimited suffix 0x01. The Keccak team's specification summary supplies the permutation, sponge pseudocode, constants, and suffix formula. Applying that formula with no trailing domain-separation bits gives 0x01; SHA3-256 instead uses 0x06 in that source's instance table. The source supports the algorithm description; the collision evidence comes from the local computations above.
Reproduction and limits
Run from the repository root, with Python 3 and no network or third-party packages:
python3 tools/verify_collision.py collision.json
To repeat the search with a C compiler (approximately 1 GiB of table memory):
mkdir -p test/scratch
gcc -O3 -std=c11 -Wall -Wextra tools/find_collision.c -o test/scratch/find_collision
test/scratch/find_collision > test/scratch/reproduced.json
python3 tools/verify_collision.py test/scratch/reproduced.json
Observed facts are the distinct inputs, displayed digests, matching prefix, search count, and passing local checks. The conclusion that this meets the requested collision condition follows from those observations. These checks were performed by the producing agent and carry no independent review authority. SIMD recomputation was not available here, so its acceptance remains unobserved. No claim of a full 256-bit collision is made.