Keccak-256 collision at 48 bits (lambda = 24)

Result: locally verified

The distinct eight-byte inputs in collision.json have identical first six digest bytes, 0x8851a59bbb9d. Each 0x string is decoded as hexadecimal bytes, not hashed as literal text.

Field	Value
inputA	0x8375360100000000
inputB	0x7131040200000000
Keccak-256(inputA)	8851a59bbb9d6231d46ab9566296d3aed4afb5cd4212a1f68a094142b0366868
Keccak-256(inputB)	8851a59bbb9d27a12c8340ba34a0ac8820e6315e00542945f74d66f4ef53a9b1
First 48 bits, MSB	0x8851a59bbb9d

The full digests differ; the claimed collision is specifically for the requested 48-bit truncation.

Method and attributable evidence

The local C search enumerated eight-byte little-endian integers starting at zero, storing 48-bit digest prefixes in an open-addressed table. The two counters were 20,346,243 and 33,829,233. It found the pair after 33,829,234 evaluations; search.log records progress and the final count. The search used all 24 rounds of Keccak-f[1600], rate 1088, capacity 512, and the original Keccak suffix 0x01.

The Keccak team's specification summary describes the permutation, sponge construction, and suffix encoding. Its formula gives 0x01 when no domain-separation bits are appended; SHA3-256 uses 0x06. The first six serialized digest bytes are the most significant 48 bits of the displayed hexadecimal digest.

The offline verifier recomputed both full digests with two implementations: a local direct Python model and the XKCP compact Python reference by Gilles Van Assche. The latter is vendored unchanged with its CC0 notice; provenance and file checksum identify the downloaded bytes. The reference is called as Keccak(1088, 512, input_bytes, 0x01, 32).

Observed checks:

• Both implementations matched known-answer vectors for empty input and abc.
• The implementations agreed on 12 message lengths, including 135, 136, 137, 271, and 272 bytes.
• The delivered JSON has exactly the four required fields, the requested algorithm and integer lambda, and distinct decoded inputs.
• Both implementations agreed on each full candidate digest and its matching six-byte prefix.

verification.json contains the recorded output. Reproduce the decisive checks without network or package installation:

python3 -B src/verify.py

Conclusions and limits

The observed digest equality establishes the requested truncated collision under the two local implementations. No estimate of birthday probability is used as evidence that this particular pair works. These are local self-checks, not independent review or a SIMD verifier verdict. The external SIMD outcome remains unobserved; no acceptance is claimed. The prior attempt's stated failure was model capacity/runtime availability, and no files or results from it were reused.