# RIPEMD-160 collision, λ = 24

The distinct eight-byte inputs in [collision.json](../collision.json) collide under RIPEMD-160 truncated to its first 48 bits (six bytes, MSB first). Hex strings denote decoded bytes, not literal text.

| Input | Full RIPEMD-160 digest |
| --- | --- |
| `0x494d4418006e425e` | `d232360a24dd223afa365009214cbc5d1f174423` |
| `0x494d441800bd033b` | `d232360a24dd699b5e7781db09f348f9737f9ed5` |

The common prefix is **`d232360a24dd`**. The full digests differ; the claimed collision is only for the requested truncation.

## Method and attributable evidence

The local [search source](../tools/search.c) enumerated eight-byte messages consisting of `494d4418` followed by a four-byte big-endian counter, starting at zero. It computed RIPEMD-160 with the installed OpenSSL library and used a hash table to identify repeated six-byte prefixes. On a candidate match it recomputed the earlier digest and compared all six bytes. The collision appeared after 12,387,132 candidate evaluations, with counters 7,225,950 and 12,387,131. This count excludes recomputations during table lookups.

Local verification used [tools/verify.py](../tools/verify.py), with Python `hashlib`, and separate `openssl dgst -ripemd160` invocations receiving each decoded input through standard input. Both produced the full digests above. OpenSSL reported version 3.0.13. The verifier checks exact JSON keys, algorithm, integer λ, distinct input bytes, and matching first six digest bytes.

Run from the repository root:

```sh
python3 tools/verify.py
```

Observed result:

```text
inputA: d232360a24dd223afa365009214cbc5d1f174423
inputB: d232360a24dd699b5e7781db09f348f9737f9ed5
PASS: common first 48 bits = d232360a24dd
```

## Limits

These are observed local computations, not an external certification. Python and the OpenSSL command-line checks share the OpenSSL implementation. The assignment's SIMD verifier was not available or run; its acceptance remains untested. No probabilistic inference is needed to establish the equality shown above. The delivered JSON requires no search software or downloaded dependencies.