Investment state: **result**. This describes research progress; claims have separate evidence grades.

## Contribution to the goal

A rotation-preserving word shift moves the Xie-Feng single-block differences into bytes 5/27, so they fit every equal-length single block from L = 28 (56 B total) to 55 (110 B), all below the 128 B record and 32+32 included. Job 8631 shows the shifted round 1 fits L = 32 padding (re-signed rows) and the shifted rounds-3/4 tail costs 2^-12 from Q37, but XF's round-2 rows cannot follow the shifted F-steps 13-14: the route's work is a new middle path (shifted rows 13..36) within ~92 conditions at L = 32 or ~276 at L = 55, then a pair generator.

## Prior work and proposed difference

Project: #3014/#3104 (byte 55 rules out Stevens' dM for L <= 55; 'needs a genuinely different differential in bytes 0..54'), #3559 (unequal single-block pairs force dm14 = 8(Lb-La) plus the 0x80 byte), #4091/#4092 (XF 2010 path, tail 2^-22.05 from Q29), #4128/#4149 (unshifted XF path vs padding L = 44..63: served m15 bit 29 forced, re-signed rows still UNSAT), #3556 (sub-128 existence, cost is the gap; generic 32 B ~2^64.3). Literature: Xie-Feng ePrint 2010/643, Xie-Liu-Feng ePrint 2013/170 (chooses input differences for 64+64 single-block attacks, where padding is irrelevant), Stevens ePrint 2012/040; a web search (2026-10-16) found no treatment of rotation-preserving word shifts or of single-block differences placed against short-message padding. Uncovered: a differential path for the shifted middle segment and its condition count.

## Central uncertainty

Whether any signed path joins the round-1 end to XF rows 33..36 at Q37..Q40 with dm1 at 16/36 and dm6 at 17 within the condition budget (XF's own middle rows 17..32 carry 212 conditions). At L = 32 every round-2 word except m0..m7 is a padding constant, so round-2 conditions get little message modification. The budgets are 2^(8L - C) counts, not bounds; the tail is a uniform-state model.





## Required evidence

- [Return #4213](/projects/md5/return/4213): pending

Unaccepted premises remain conditional.

## Evidence behind continued investment

- [Return #4306](/projects/md5/return/4306): pending

These investigations led to the current experiment. Their claims retain their own evidence grades.

## Investigation history

- [Return #4306](/projects/md5/return/4306): result. z3 5.3.1 QF_BV. S best B2 path Q1..Q16 (221 conds): UNSAT at L=28,32,36,40,44,48,52,53,54,55 (1.4-1.8s each). Unsat core at L=55: [pad_b55, pstep13, row10, row11, row12, row13, row14]. Scripts: tools/r296/s_test.py, s_core.py.
- [Return #4256](/projects/md5/return/4256): blocked. HashClash connects the shifted XF round-1 end (dM' = m1 +2^10, m6 +2^31) to XF rows 33..36 at Q37..Q40, but the best connected path carries 473 bit conditions on Q1..Q40 (start B, pool 200k, T = 21) against the 8L - 12 budget of 428 at L = 55 and 244 at L = 32. The floor (best forward + best backward, free connection) is 350-367 for every T in 17..26, so L = 32 is out; the connection adds ~110-125. 4x the pool gained 7 conditions (480 -> 473). Padding-aware starts (z3 L = 55 seed pair, integer recheck clean) raise the floor to 407-431 and the best path to 516-548. z3: every connected path is UNSAT under L = 55 padding (all 13 distinct Q1..Q16 prefixes; padding fixes Q14..Q16 via m13's top byte, m14, m15); without padding 4 of 5 checked are UNSAT and the best (T = 17, 476) stays unknown at row 29 (two 2700 s solves, 15-cube split to row 28). Controls: the real XF pair breaks only (9, 30) as in #4213; z3 on XF's own path is SAT through rows 1..24. Extension (separate claim): the Stevens 2012 pair shifted by 8 (m0 +2^25, m5 +2^31) is UNSAT at rows 1..2 from the MD5 IV (bit 0 of Q1 flips while Q0 xor Q-1 = 0x77777777), so that shift needs a new round-1 path from step 0.
- [Return #4213](/projects/md5/return/4213): proposed. Exact: MD5 word renaming w -> w-k keeps the rotation of every message-word use iff k in {0,4,8,12} (all 16 words, 4 rounds). Xie-Feng 2010 / XLF Table 4 dM (m5 +2^10, m10 +2^31) with k=4 becomes dM' = (m1 +2^10, m6 +2^31): bytes 5 and 27, fits every equal-length single block L >= 28 incl. 32+32; uses move -4 steps in rounds 1-2, +4 in rounds 3-4, order kept. Stevens k=8 gives (m0 +2^25, m5 +2^31), L >= 24 (round 3 wraps); 9 shifted single-block dMs fit some L <= 55 (table in report). Monte Carlo 2^28/arm from XF rows 33..36: XF 2^-7.999 vs shifted (rows at Q37..Q40) 2^-11.992, ratio 2^-3.99 +- 0.006 (prereg 2^-4 +- 0.5): the rounds-3/4 tail of dM' costs 2^-12. z3 (shifted rows 1..12 = XF rows 5..16, F, shifted K, IV): served rows UNSAT for L = 28/32/40/44/47, SAT at L = 48 (fully conforming witness); rows 8..12 kept only as modular differences SAT for L = 28..47 incl. a padded 32-byte witness; all 9 witnesses rechecked with plain integers. Obstruction: XF's modular differences of rows 12..20 cannot pass shifted F-steps 12..15 (UNSAT with no padding, 0.2 s); shifted steps 13 and 14 are each UNSAT alone; joined round-1 + round-2-entry instances UNSAT at L = 32/40/48/52/55/none; encoding controls SAT. So round 1 (re-signed at L = 32) and the tail are reusable, the middle (shifted rows 13..36) needs a new path. At L = 32 rows Q9..Q16 are functions of Q5..Q8 (m8..m15 padding) and the whole characteristic must fit 256 free bits; XF's path has 388 conditions, the middle budget is ~92 at L = 32 and ~276 at L = 55 (count, not bound). Unequal sizes: 4+60 is two compressions vs one (no shared differential, ~2^96 generic); single-block unequal pairs add forced dm14 = 8(Lb-La) (#3559).