# Report: 48-bit truncated RIPEMD-160 collision (λ=24)

## Answer
```json
{"algo": "ripemd160", "lambda": 24, "inputA": "rmd160-9467736", "inputB": "rmd160-16123348"}
```
Both inputs are UTF-8 strings. They are distinct, and their digests share the 48-bit prefix `12831c48ee1a`.

## Facts (directly observed in this run)
- `RIPEMD160("rmd160-9467736")  = 12831c48ee1ac8a15823d8ef3a1be1665ccfac1a`
- `RIPEMD160("rmd160-16123348") = 12831c48ee1a63193ea415ec0aa3b910ade306a0`
- The first 6 bytes (48 bits, MSB-first) are equal. The full digests differ.
- Three independent implementations produced these values:
  1. Python 3.12.3 `hashlib.new("ripemd160")`, backed by OpenSSL 3.0.13.
  2. `openssl dgst -ripemd160` from the OpenSSL 3.0.13 CLI.
  3. A standalone pure-Python RIPEMD-160 written from the spec's constants. Before it was used, it passed the known-answer tests for `""` → `9c1185a5…8d31`, `"abc"` → `8eb208f7…0bfc` and the first word of 10^6 × `"a"` → `52783243…`. These test vectors are from the RIPEMD-160 reference page by Bosselaers: https://homes.esat.kuleuven.be/~bosselae/ripemd160.html
- The search (`scripts/find_collision.py`) hashed `rmd160-0`, `rmd160-1`, … in order. It found the first prefix repeat at evaluation 16,123,349, about 2^23.94, after 1m48s of wall time.

## Inferences
- The cost matches the generic birthday bound. For an n=48-bit output, the expected number of evaluations to the first collision is about √(π/2 · 2^48) ≈ 2.1·10^7 ≈ 2^24.3. The observed 1.6·10^7 is within normal variance. The task states the cost as ~2^24.
- No structural weakness of RIPEMD-160 was used or needed. The result is generic to any hash truncated to 48 bits.

## Uncertainty
- I assume the verifier treats inputs without a `0x` prefix as UTF-8 bytes, as the task format (`"<hex 0x... or utf8>"`) describes. I did not run the external "SIMD" verifier. It cannot be reached from here.
- The pure-Python cross-check was written for this task, and its third known-answer test compared only the first 4 bytes. Its agreement with OpenSSL on all the digests above is still strong evidence that it is correct.

## Unanswered questions
- None about the collision itself. This work does not address whether full-length RIPEMD-160 collisions are feasible. The best published attacks are on reduced-round variants, and that topic was out of scope.