# RIPEMD-160 truncated-50-bit collision (λ = 25)

## Answer

```json
{"algo":"ripemd160","lambda":25,"inputA":"imd-6952175","inputB":"imd-55049483"}
```

Both inputs are UTF-8 strings, with no trailing newline.

| input | RIPEMD-160 digest (full) | first 50 bits (hex, right-aligned) |
|---|---|---|
| `imd-6952175`  | `b6972870fbd64b55df0c43bad001b8f9fd428036` | `0x2da5ca1c3ef59` |
| `imd-55049483` | `b6972870fbd668c35f15b2a8b04b95626f232941` | `0x2da5ca1c3ef59` |

The first 48 bits match (`b6972870fbd6`). The next nibble is `4` (`0100`) in one digest and `6` (`0110`) in the other, so bits 49–50 (`01`) also match. Bit 51 is the first one that differs.

## Evidence (facts: commands run on this machine)

- Search: `python3 tools/find_collision.py` (committed in this repo) hashed `imd-0` … `imd-55049483` on 4 processes in about 47 s of wall time. It stopped at the first repeated 50-bit prefix. That was about 0.82 × 2^26 evaluations, close to the expected birthday cost of about 2^25.5.
- I computed the digests two separate ways, and they agree:
  1. Python 3.12.3 `hashlib.new("ripemd160")`. As a sanity check, it returns the known RIPEMD-160 test vector for the empty string, `9c1185a5c5e9fc54612808977ee8f548b2258d31`.
  2. The OpenSSL CLI: `printf %s imd-6952175 | openssl dgst -ripemd160` and the same command for the second input. Its output is the full digests shown in the table.
- I recomputed the check `inputA != inputB` and `int(digest) >> 110` (the top 50 of 160 bits) for both inputs. Both give `0x2da5ca1c3ef59`.

## Inferences and assumptions

- "Truncated to the first 50 bits MSB" is read as the 50 most significant bits of the 160-bit big-endian digest. This is the natural reading, but the brief does not define it formally.
- The inputs are meant to be read as UTF-8 text. They do not start with `0x`, so they cannot be mistaken for hex.

## Uncertainty / open questions

- I have not seen the verifier ("SIMD") implementation. If it truncates differently (for example, little-endian, or the low 50 bits), this pair would not count. The full digests above let anyone check any convention.
- This is a generic birthday collision on a truncated output. It says nothing about the security of full 160-bit RIPEMD-160.

## Sources

- RIPEMD-160 specification and test vectors: Dobbertin, Bosselaers, Preneel, https://homes.esat.kuleuven.be/~bosselae/ripemd160.html