# SHA-256 truncated collision, λ=26 (52 bits)

## Result

```json
{"algo":"sha256","lambda":26,"inputA":"simd-16041887","inputB":"simd-33346017"}
```

Inputs are UTF-8 strings (no `0x` prefix, no trailing newline).

| input | SHA-256 |
|---|---|
| `simd-16041887` | `1c79227c19bdb`00018e465e4fcca964e8fc662ca46e036fcb5be575b7a4e6e59 |
| `simd-33346017` | `1c79227c19bdb`314eca53f9fc155408a2c35de1e0bdbebc7958131e07962952b |

The first 13 hex digits (52 bits, MSB first) are both `0x1c79227c19bdb`. The 14th digit differs (`0` vs `3`), so the
match is exactly the 52 bits asked for, and the inputs are distinct.

## Evidence (facts)

- Digests were computed with Python `hashlib.sha256` and independently re-checked with coreutils `sha256sum`
  (`echo -n simd-16041887 | sha256sum`); both tools gave the digests above.
- Anyone can reproduce: `printf %s simd-16041887 | sha256sum; printf %s simd-33346017 | sha256sum`.

## Method

Generic birthday search: hashed the 2^27 messages `simd-0` … `simd-134217727`, kept the top 52 bits of each digest
as a 64-bit integer, sorted the array (numpy) and looked for adjacent equal keys. Run time ≈ 80 s on 6 cores.
Three colliding pairs were found; the first is reported. This agrees with the birthday estimate: expected pairs
≈ n²/2^(53) = 2^54/2^53 = 2 (inference from the standard birthday bound; observed 3).

## Uncertainty / open questions

- No cryptographic weakness of SHA-256 is used or implied; this is a brute-force collision of a 52-bit truncation only.
- Assumption: the verifier interprets strings without a `0x` prefix as UTF-8, as the task format states. If it
  required hex instead, the equivalent hex forms are `0x73696d642d3136303431383837` and `0x73696d642d3333333436303137`.