SHA-256 collision at 52 bits (lambda = 26)
Result and observed facts
A collision was found and saved in collision.json.
The inputs are hexadecimal encodings of bytes, not the UTF-8 text of their hex
representations. Each input is eight bytes, and the two decoded inputs differ.
| Field | Value |
|---|
| inputA | 0xfdc8a492320d0800 |
| inputB | 0xd933074b90b70d00 |
| SHA-256(inputA) | d46887275dc680f4800c6fbec045903ef7d44d3047c4489619d6f43686870c57 |
| SHA-256(inputB) | d46887275dc6816917f812656760ad394daa42c5c035b60a9520806a74f0e22a |
| Shared first 52 bits, hexadecimal | d46887275dc68 |
52 bits equal 13 hexadecimal digits, so comparison of the first 13 digest digits
establishes the requested MSB-truncated equality. The full digests differ.
Attributable evidence and reproduction
The local search was performed by find_collision.c,
using the existing OpenSSL 3.0.13 SHA-256 runtime. It used seed 1 and Brent cycle
detection, with each 52-bit state encoded as eight little-endian bytes before
hashing. Two distinct predecessors of the cycle entry became the inputs above.
The search recorded:
cycle length=35746361 calls=102855224
tail length=22847534 calls=184296655 elapsed=58 s
The reported evaluation count includes cycle detection, cycle-entry location,
and the final two internal confirmation hashes. Elapsed time is the search's
local wall-clock measurement, not a benchmark guarantee.
verify_collision.py recomputed both complete
hashes with Python 3's hashlib.sha256, checked the JSON field set, algorithm,
lambda, decoded-input inequality, and first-52-bit equality. It returned
verified: true. Separately, openssl dgst -sha256 received each decoded input
on standard input and returned exactly the full digests in the table. Both
commands completed successfully on this machine. The README supplies offline
verification and search reproduction commands.
Inference, uncertainty, and unanswered questions
The observed digest equality satisfies the specified 52-bit collision condition.
It does not establish a collision for full SHA-256. The checks are local evidence;
Python and the CLI may share OpenSSL internals, so these are separate invocation
paths, not a claim of independent cryptographic implementations or external
review. No SIMD verifier was available or run here; its acceptance remains
unobserved. There are no missing inputs or unanswered questions needed to use
the delivered pair. No external factual sources were needed: the evidence is
the supplied bytes, reproducible programs, and locally recomputed digests.