I'll find a keccak256 collision truncated to 48 bits via birthday search. First, let me inspect the environment.Empty repo, 4GB RAM, gcc available. I'll write a C keccak-256 implementation and run a birthday search (~2^24 evaluations). First, the scratch directory and the C code.Now I'll write the collision search program: a keccak-256 implementation plus a hash table over the truncated 48-bit key.Compile and run the search.Self-test failed — let me cross-check against Python reference implementations to see whether the bug is in the C code or my expectation.No pycryptodome. I'll write an independent pure-Python keccak-256 reference — useful both to debug the C code and to verify the collision later.The Python reference gives the correct c5d24601... for empty input, so my C code has a bug. Let me compare the permutation state after one round in both implementations.Now the Python equivalent for comparison.States diverge within the first round. Let me isolate theta vs rho/pi/chi.Found it — theta matches, rho+pi diverges at the last two chain positions. Recomputing the π-cycle rotation offsets by hand gives ..., 61, 20, 44 at the end, not ..., 66, 30 (which would also be a shift > 63, i.e. UB). Fixing the table.Collision found after ~10.8M evaluations. Now let me verify it independently with the pure-Python keccak implementation.Independently verified — both implementations agree on 2c705490d170 for the first 48 bits. Now writing the deliverables.Now copy the tools into the repo as reproducibility evidence and do a final sanity check of collision.json.artifacts/ didn't appear in git status — let me check whether it's ignored or missing.Both output paths are git-excluded as required. Let me commit the tools as evidence and finish.No git identity is configured and I must not modify git config, so the tools stay as untracked files alongside the outputs — that satisfies the delivery rules since the verifier recomputes keccak itself and needs no committed dependencies.

Done. Summary:

• Collision found after ~10.77M keccak-256 evaluations (consistent with the ~2^24 birthday bound):
  • inputA = 0x0000000000a445ea
  • inputB = 0x00000000009f3c16
  • Both digests begin with 2c705490d170 (48-bit MSB prefix), diverging at byte 7.
• Verification: two independent implementations agree — a C keccak-256 (birthday search, self-tested against the keccak256("") = c5d24601... vector) and a separately written pure-Python keccak-256 (validated against published vectors). During development the empty-string self-test caught a transcription bug in the rho-offset table (66, 30 → corrected to 20, 44, recomputed along the pi cycle; 66 would have been a >63-bit rotate).
• Deliverables:
  • collision.json — exact required schema, validated by parsing + recompute.
  • artifacts/report.md — method, evidence, and limits (notes the hex-encoding assumption as the only residual uncertainty).
  • tools/find_collision.c, tools/keccak_ref.py — reproducibility evidence; both output paths are git-excluded per the task rules.