SHA-256 collision in the first 48 bits (λ = 24)
A collision was found and locally verified. The deliverable is collision.json.
Observed result
The 0x strings encode raw bytes, not the UTF-8 characters of their hexadecimal representation. Each input is eight bytes.
| Field | Value |
|---|
| inputA | 0xe8f1380000000000 |
| inputB | 0x23f68e0000000000 |
| SHA-256(inputA) | 67171c0eb1922b1b1e7b76dd2213a661d3542f3c6b00e39279800abaaf50b502 |
| SHA-256(inputB) | 67171c0eb192a147eff93d18c3adf2a803bba554778ef76416669125a3a46e19 |
| Common first 48 bits (six bytes) | 67171c0eb192 |
The inputs are distinct. The first twelve hexadecimal digest digits match, which establishes the requested 48-bit MSB collision. Their full 256-bit digests differ.
Attributable evidence and reproduction
These values are outputs of local computation, not externally sourced claims. The included search source implements SHA-256 for eight-byte messages and searches consecutive unsigned counters encoded in little-endian order. A hash table retains digest prefixes and enough counter information to recover a prior matching input.
The search examined counters 0 through 9,369,123 inclusive. It found counters 3,731,944 and 9,369,123. Its diagnostic output was:
Found counters 3731944 and 9369123; prefix 67171c0eb192; counters searched 9369124
The C prefix implementation was cross-checked against Python hashlib on 1,000 eight-byte inputs: counters i * 0x9e3779b97f4a7c15 reduced modulo 2^64 for i from 0 through 999. All matched. Compilation with -O3 -Wall -Wextra -Werror succeeded.
The included verification script checks the exact JSON field set, algorithm, integer lambda, distinct decoded bytes, and equality of the first six digest bytes. Run offline from the repository root:
python3 tools/verify_collision.py
Observed output:
inputA bytes: e8f1380000000000
inputB bytes: 23f68e0000000000
SHA256(inputA): 67171c0eb1922b1b1e7b76dd2213a661d3542f3c6b00e39279800abaaf50b502
SHA256(inputB): 67171c0eb192a147eff93d18c3adf2a803bba554778ef76416669125a3a46e19
Matching first 48 bits: 67171c0eb192
PASS
Both full digests were also recomputed by piping each decoded eight-byte input to openssl dgst -sha256 (OpenSSL 3.5.7). Both matched the table above. Python and OpenSSL may share a cryptographic backend; they are separate checks, not a claim of fully independent implementations. The search uses its own C implementation.
To reproduce the deterministic search, using a C compiler and approximately 512 MiB for the table:
gcc -O3 -Wall -Wextra -Werror tools/find_collision.c -o /tmp/find_collision
/tmp/find_collision > /tmp/collision-reproduced.json
cmp collision.json /tmp/collision-reproduced.json
No downloaded libraries or network access are needed for either delivered utility. Search requires a C compiler; verification requires Python 3 with its standard library.
Scope and limits
The conclusion follows from the distinct input bytes and equal computed six-byte prefixes. This is a truncated-digest collision only. The local checks do not constitute independent reviewer certification, and the external SIMD verifier was not available in this session. External acceptance remains unobserved; there are no unresolved local mismatches.