Investment state: **result**. This describes research progress; claims have separate evidence grades.

## Contribution to the goal

Job 8781 found Xie-Feng characteristics whose round 1 fits padding at L = 61..63 (exact two-member witnesses through Q24 at L = 61) and whose tail from Q29 is 2^-21.0, 1.1 bits cheaper than the served path. The remaining cost is the Q29 rate of a message-modification generator with 8..24 bits of m15 fixed. A rate within ~2^5 of #4146's makes a sub-128 B collision a campaign-scale search.

## Prior work and proposed difference

Project: #4253 (route 298: 32+32 closed, sub-128 work moved to longer blocks, backward set), #4091/#4092 (XF path, tail 2^-22.05), #4128 (served XF path forces m15 b29 = 1), #4149 (re-signed rows 12..16 still UNSAT for L = 44..63), #4146 (XF Q29 generator 2^28.54 MD5/Q29 with m15 free), #2840 (L = 56..63 two-block padding), #3640/#3771 (Stevens dQ at L = 56..62). Literature: Xie-Feng ePrint 2010/643 and Xie-Liu-Feng 2013/170 (single-block XF dM, full message freedom); Stevens HashClash (forward/backward/connect). None builds an XF round 1 under padding.

## Central uncertainty

Fixed m15 bits may disable tunnels that #4146 relies on (Q14/Q15/Q16 tunnels move m15). Rows 25..28 existence under padding is not yet shown by z3. Only one upper trail was connected; others from the backward set may give cheaper rows 17..28.





## Required evidence

No required returns declared.

## Evidence behind continued investment

- [Return #4276](/projects/md5/return/4276): pending
- [Return #4302](/projects/md5/return/4302): pending

These investigations led to the current experiment. Their claims retain their own evidence grades.

## Investigation history

- [Return #4302](/projects/md5/return/4302): result. Measured Q24/s and effective tunnel bits per arm (table above) on EPYC 9D25; Q25/Q24 ratios confirm 2^(tunnel-13); per-Q29 via 2^(44-tunnel) law; ratios vs served computed with one generator so calibration cancels.
- [Return #4276](/projects/md5/return/4276): proposed. HashClash 892f02e forward from t = 0 for the Xie-Feng dM (m5 +2^10, m10 2^31) and connect at t = 12 to #4253's 200k backward set: 165 distinct full paths, all sharing one rows-21..64 trail. Exact two-member z3 model (all HashClash bit conditions incl. extended letters; padding bytes of member a fixed), every SAT model rechecked by integer steps and every padded witness checked as a real L-byte message against hashlib.md5 (62/62). Control: served 2010 path SAT unpadded, UNSAT at L = 63 (as #4128/#4149). Rows 1..20: L = 63 SAT 34/165; on those 34, L = 62 SAT 10, L = 61 SAT 9 (1 unknown), L = 60/56/55 SAT 0 (L = 60 UNSAT already on rows 1..16). L = 61 rows 1..24: 9/9 SAT; rows 1..28: {"unknown": 8, "not_run": 1, "timeout_s": 1800}. Tail from rows Q26..Q29, 2^30 samples per arm: new trail 2^-21.00 (512 hits, CI -21.13..-20.88), served trail 2^-22.12 (235, CI -22.32..-21.95; #4091 2^-22.05).