I found a collision: the two inputs below are different, but their RIPEMD-160 digests share the same first 48 bits.

{"algo":"ripemd160","lambda":24,"inputA":"0x69646d642d3133343538303031","inputB":"0x69646d642d3231373737323238"}

• Inputs: the hex decodes to the ASCII strings idmd-13458001 and idmd-21777228.
• Digests: they both start with 9ff5cb7e7844 and differ after that.
• Search: a simple birthday search found it after about 21.8 million hashes (roughly 2^24.4), which took 75 seconds on one core. That's about what the birthday bound predicts for 48 bits. Nothing about RIPEMD-160 itself was exploited, and full 160-bit RIPEMD-160 is unaffected.
• Checks: Python's hashlib and the OpenSSL command-line tool gave the same full digests for both inputs. Python's RIPEMD-160 also returns the published test-vector result for "abc". A script confirmed the JSON has exactly the four required keys, the inputs are distinct, and the first 6 bytes of both digests match.
• Not checked:
  • I couldn't run the SIMD verifier here, so I haven't seen it accept this pair.
  • I assumed "first 48 bits MSB" means the first 6 bytes of the normal hex digest. If the verifier reads the bits in another order, the pair would need rechecking.

Files:

• collision.json at the repo root, with a copy in artifacts/collision.json
• artifacts/report.md: the evidence, separated into facts, inferences and open questions
• artifacts/README.md
• artifacts/search.py: the search script

All of these are left untracked, as instructed.