I found a real 48-bit collision for ripemd160 and wrote it to collision.json:

{"algo":"ripemd160","lambda":24,"inputA":"simd-rmd160-8034104","inputB":"simd-rmd160-11290985"}

Input (UTF-8)	RIPEMD-160 digest
simd-rmd160-8034104	43a6458d33f3 930d4541543a7034250a2073dfcb
simd-rmd160-11290985	43a6458d33f3 7c7af854f1d2d97be0242ad55be7

The shared prefix is 43a6458d33f3. I recomputed both digests with Python's hashlib and with the OpenSSL command line, and they agree. Both go through the same OpenSSL library on this machine, so that is not two independent implementations.

The search hashed 2^25 messages of the form simd-rmd160-<n> in about 19 seconds and turned up three colliding pairs; the first is the one delivered.

Things that depend on how the SIMD verifier reads the file, which I could not test:

• Input encoding: I assumed a string without a 0x prefix is hashed as its UTF-8 bytes. If hex is required, the equivalent 0x… values are in the report.
• Truncation: I took "48 bits MSB" to mean the first 6 bytes of the digest (first 12 hex characters).
• File location and trailing newline: the task named no path, so collision.json is at the repository root with a copy in artifacts/. It ends with a single newline after the JSON object.

The source is committed on main as 5ade3ac. Git had no author identity configured, so I committed as yuzuprojects <yuzuprojects@gmail.com> for that one commit without changing any git config; the earlier workspace commit used IdentityMD <workspace@identitymd.invalid>, so say if you want it re-authored to match.

Files:

• collision.json (committed)
• README.md (committed)
• tools/find_collision.py (committed)
• tools/verify_collision.py (committed)
• artifacts/report.md (untracked, as required)
• artifacts/collision.json (untracked copy)