Keccak-256 collision in the first 48 bits

Result

A collision was found for the requested 48-bit MSB truncation (lambda = 24). The submitted file is ../collision.json:

{"algo":"keccak256","lambda":24,"inputA":"0x8375360100000000","inputB":"0x7131040200000000"}

Both inputs are hex-encoded raw eight-byte messages, not UTF-8 representations of the hex strings. Their decoded byte sequences are distinct.

Input	Full Keccak-256 digest
0x8375360100000000	8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868
0x7131040200000000	8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1

The first six digest bytes (12 leading hexadecimal digits, 48 MSB bits) are 8851a59bbb9d in both cases. The full 256-bit digests differ.

Attributable local evidence

• search-result.txt records the C searcher's matching counters, 20346243 and 33829233, and both full digests. Each counter was encoded as an unsigned eight-byte little-endian integer.
• search-progress.txt records a match after 33,829,234 evaluations, with an elapsed time of 85 seconds as measured by the process's wall clock. The initial, smaller search exhausted 33,554,432 candidates without a match; its log is initial-search-progress.txt. The expanded run restarted at zero, so these runs performed 67,383,666 evaluations in total.
• verification.txt records the separate Python verifier's recomputed digests, equal prefixes, and successful schema and distinctness checks. It also records two Keccak known-answer checks (empty message and abc), ten SHA3-256 comparisons against hashlib using the SHA3 suffix, and five C/Python digest comparisons.

The search source is ../tools/search.c, generated by ../tools/generate_search.py. Its hash table compares all 48 retained digest bits before declaring a match. The independent Python implementation in ../tools/verify.py generates round constants and rotation positions algorithmically, whereas the C code uses explicit constants and generated fixed-index operations.

Recompute the checks offline from the repository root:

python3 tools/verify.py

The verifier uses Python's standard library and the included Linux x86-64 search executable for the C cross-checks. Rebuild instructions and the vendored compiler's provenance are in ../README.md and ../tools/vendor/README.md.

Algorithm interpretation and source

The computation uses Keccak-f[1600] with 24 rounds, a 1088-bit rate, 512-bit capacity, and the original Keccak delimited suffix 0x01. Digest bytes are serialized from little-endian lanes. The Keccak team's specifications summary describes the permutation, sponge construction, constants, and suffix rule. With no domain-separation bits, that rule gives 0x01; SHA3-256 instead uses 0x06. The submitted digests use the former. Source consulted 2026-10-05.

Conclusion and limits

Observed fact: two local implementations recompute the full digests above, and their first six bytes agree for distinct decoded inputs. The resulting inference is that collision.json satisfies the requested 48-bit collision condition. This does not establish a collision in full Keccak-256.

These are attributable, reproducible local checks, not independent certification. The external SIMD verifier was not available in this workspace and was not run; its acceptance remains unobserved. No external acceptance is claimed.