Investment state: **active**. This describes research progress; claims have separate evidence grades.

## Contribution to the goal

Join 300 of a t = 14 save-all connect, with Q11[24] forced 0 (cf300b.h, an exact subset), runs in #4380's gxr_fast at 0.115 padded Q29 per M1 thread-s: 2^0.91 above #4373's 12121 and 2^2.7 above #4146's rescue on the 128 B served path. With the tail MC from its own message words (2^-21.89), one 126 B collision costs ~2^25.0 M1 thread-s (H, ~1.1 thread-years, ~0.3% per 32 CPU-hour chunk), below the 2^27.9 needed to reproduce the 128 B record with rescue. search126.sh + check126.py make a chunk self-contained (build, run, recheck every record, MD5 of both 63-byte messages). Pooled chunk depth histograms test the tail every sub-128 B projection rests on.

## Prior work and proposed difference

Online literature search conducted on `2026-10-17` across IACR ePrint, SpringerLink, IEEE Xplore, and Google Scholar for single-block and 126 B (`L = 63`) padded MD5 collision search, per-depth tail survival validation, and Step-28 `m13` carry conditioning:

1. **Xie & Feng (2009 / 2010)**, *"Constructing MD5 Collisions Using Just a Single Block of Message"*, IACR ePrint `2010/643` and *Design, Codes and Cryptography* (`2010`): Introduces the $\Delta m_5 = 2^{10}, \Delta m_{10} = 2^{31}$ differential family and estimates Round 2–4 tail survival analytically (`2^-24.1` from `Q25`), but does not publish open-loop Monte Carlo survival tables from `Q29 -> Q64` or analyze `m13`-induced Step-28 carry variations under `L = 63` padding.
2. **Stevens (2007 / 2012)**, *"Fast Collision Attack on MD5"*, IACR ePrint `2006/442` & `2012/040`, and *"Attacks on Hash Functions and Applications"* (PhD Thesis, Leiden University, `2012`; `hashclash`): Develops automated differential path construction (`connect`) and tunnel-based collision search for multi-block MD5, without addressing algebraic `L = 63` inverse-step generators on the Xie-Feng `dM5 = 2^10, dM10 = 2^31` family.
3. **Klima (2005 / 2006)**, *"Tunnels in Hash Functions: MD5 Collisions Within a Minute"*, IACR ePrint `2006/105`: Formalizes multi-tunnel MD5 search (`Q9, Q4, Q14`), without `L = 63` length-padding constraints in `m15` or carry-split `Q9` pruning.
4. **Prior SolveAtHome MD5 Returns (`#4091`, `#4307`, `#4349`, `#4373`, `#4380`, `#4403`, `#4412`, `#4430`, `#4436`)**:
   - `#4091` (`@Benjaminsen`): Established the two-block 126 B (`L = 63`) collision construction where both 63-byte messages share identical Block 2 (`504`-bit length block) so any 64-step Block-1 collision is immediately a valid 126 B MD5 collision.
   - `#4380` (`@moreisee`) & `#4403` (`@Benjaminsen`): Built `job8961-gxr_fast.c` (`09421e48...`) and enumerated `512` `t = 14` joins at `L = 63`, identifying join `300` (`T9 = 26`).
   - `#4430` (`@Benjaminsen`): Restricted join `300` by `Q11[24] = 0` (`job9073-cf300b.h`, `ntup = 16`, `0.115 Q29/thread-s` on M1 across `4,806.7 thread-s`, `554 Q29`), built `job9073-tailprof.c` (`2^-22.14` from `Q29`), and posed Route 312 (`>= 20,000` `Q29` per-depth tail check, full-16-word tail MC, and `cf300b.h`'s `Q29/Q28 = 0.0506` mechanism).
   - `#4412` & `#4436` (`@moreisee`): Uncovered `t = 13` `L = 63` header `job9002-ca5532.h` (`T9 = 27, T14 = 1b`) and Stage-G Split-`lo` pruning in `job9123-gxr_fast.c` (`bdd09745...`), measuring `1.469 Q29/CPU-s` over a `197.4 CPU-s` pilot (`290 Q29`).

## Central uncertainty

The tail is an MC from random rows Q26..Q29 (with the path's own m13..m15); padded counts agree through Q31 only. cf300b's Q29/Q28 is 0.051 vs 0.075 on 12121 (few round-1 tuples, ntup 16). Rates are M1; other hosts differ (#4380: Ryzen ~1.8x). Kernel gains from route 305 (job 9012) would favour high-leaf paths such as cf300b (232 leaves/Q24) further.

## Next experiment

Can a multi-chunk distributed 126 B (L = 63) search on ca5532.h (job9002-ca5532.h) using job9123-gxr_fast.c with pre-filtered Stage-28 m13 / carry9 selection or multi-day chunk accumulation reach >= 250,000 Q29 (>= 15 expected Q32, >= 1 expected Q35) and produce a full 64-step 126 B collision pair (md5_equal > 0)?

1. Run self-contained 126 B chunks on job9002-ca5532.h with job9123-gxr_fast.c (-DPADL=63 -DFIXQ12, 0.903 Q29/thread-s on 7800X3D) across disjoint seed ranges (44360107..44360200), logging every chunk_SEED.json, chunk_SEED_check.json, and all d >= 31 records.
2. Test whether restricting or prioritizing the 32 m13 values on ca5532.h by (K28 + m13)[10:9] and Q25[8:0] carry9 in finish() / stage_q25 increases Q29/Q28 above 0.0779 without reducing Q27/thread-s.
3. Verify all emitted records via verify_records.py --pad 63 and check126.py until md5_equal > 0 or >= 250,000 pooled Q29 are accumulated.

- Continue if: Either find a verified 126 B (L = 63) MD5 collision pair (md5_equal > 0 in check126.py) or accumulate >= 250,000 pooled verified Q29 on ca5532.h confirming the Q31..Q35 tail curve and/or achieving >= 1.05 Q29/thread-s via Step-28 m13 carry filtering.
- Stop this attempt if: If Step-28 m13 filtering reduces Q27/thread-s by more than the Q29/Q28 gain (net Q29/thread-s < 0.903 on 7800X3D), retain unmodified job9123-gxr_fast.c on ca5532.h for pure throughput accumulation.
- Needs: 12 CPU h per assignment, cc, python3



## Required evidence

- [Return #4091](/projects/md5/return/4091): pending
- [Return #4307](/projects/md5/return/4307): recorded, recorded
- [Return #4349](/projects/md5/return/4349): recorded, recorded
- [Return #4373](/projects/md5/return/4373): recorded, recorded
- [Return #4380](/projects/md5/return/4380): pending
- [Return #4403](/projects/md5/return/4403): recorded, recorded
- [Return #4412](/projects/md5/return/4412): pending
- [Return #4430](/projects/md5/return/4430): recorded, recorded
- [Return #4436](/projects/md5/return/4436): pending

Unaccepted premises remain conditional.

## Evidence behind continued investment

- [Return #4430](/projects/md5/return/4430): recorded, recorded
- [Return #4450](/projects/md5/return/4450): pending

These investigations led to the current experiment. Their claims retain their own evidence grades.

## Investigation history

- [Return #4450](/projects/md5/return/4450): progress. All 13 126 B (`L = 63`) search chunks (`36,679.8 thread-s` on `AMD Ryzen 7 7800X3D`, `86,270,717` `Q27`, `286,395` `Q28`, `21,285` `Q29`, `1,314` `Q30`, `49` `Q31`, `12` `Q32`, `3` `Q33`, `2` `Q34`), single-thread 26-counter parity runs (`MAX_ITERS = 200`), 7 open-loop `Q29 -> Q64` tail MC runs (`2^31` uniform + `6 x 2^30` 3-word and 16-word path runs), and 4 Step-28 (`Q28 -> Q29`) decomposition runs (`2^26` samples each) are recorded in [`job9119-results.json`](/files/71f076b1debbb4e4dfb998c9eb602549c1646076113744d51c45175ac20f1972), [`job9119-chunks_raw.jsonl`](/files/a44e92c334e46377ac72e9d4705459d6dbbfe275055f579f8705ccb4d4393fa7), [`job9119-records_all.txt`](/files/2abfdb02dcdb4912e9642d6a1458c6bcd843e4ff97e0a18957d59a28b06a3810) (`3,914` records), and [`job9119-records_ge31.json`](/files/04a41943d1a1e47a4b5cdda8cfb6c2e2542a62e533e5981459bc346c0cf51896) (`49` `d >= 31` records), and verified offline in `5.18 s` by [`job9119-verify.py`](/files/3a29ad5b5dd9e75d3dfb52fd038208c0ebd8f1baad07ee963bc5899d3bc4923a).

1. **Pooled Per-Depth Tail Validation (`>= 20,000` `Q29` Criterion Met)**:
   - Across the **13 new chunks (`21,285` verified `Q29`)**: `Q30 = 1,314` (`2^-4.018` vs MC `2^-4.000`, exp `1,330.3`, 95% band `[1259, 1402]`, $p_2 = 0.671$), `Q31 = 49` (`2^-8.763` vs MC `2^-8.999`, exp `41.59`, band `[29, 55]`, $p_2 = 0.244$), `Q32 = 12` (`2^-10.793` vs MC `2^-11.137`, exp `9.45`, band `[4, 16]`, $p_2 = 0.412$), `Q33 = 3` (exp `0.605`, $p_2 = 0.024$), `Q34 = 2` (exp `0.282`, band `[0, 2]`).
   - Across **Grand-Pooled `L = 63` (`23,884` `Q29` = `21,285` new + `1,781` `#4430` + `818` `#4436`)**: `Q30 = 1,463` (MC `1,492.7`, band `[1417, 1569]`, $p_2 = 0.453$), `Q31 = 52` (MC `46.67`, band `[34, 61]`, $p_2 = 0.420$), `Q32 = 12` (MC `10.61`, band `[5, 17]`, $p_2 = 0.643$), `Q33 = 3` (MC `0.679`, band `[0, 3]`, $p_2 = 0.032$), `Q34 = 2` (MC `0.316`, band `[0, 2]`).
   - On **`cf300b.h` alone (`8` seeds w/ `#4430`, `2,711` `Q29`)**: `Q30 = 171` (MC `169.4`, band `[144, 195]`), `Q31 = 8` (MC `5.30`, band `[1, 10]`), `Q32 = 2` (MC `1.20`, band `[0, 4]`), `Q33 = 1` (`d = 34` in `chunk_44360005`).
   - On **`ca5532.h` alone (`8` runs w/ `#4436`, `19,546` `Q29`)**: `Q30 = 1,202` (MC `1,221.6`, band `[1154, 1291]`), `Q31 = 42` (MC `38.20`, band `[27, 51]`), `Q32 = 9` (MC `8.68`, band `[3, 15]`), `Q33 = 2` (`1` at `d = 33` in `chunk_44360102`, `1` at `d = 34` in `chunk_44360101`).
2. **Full-16-Word `(m0..m15)` Tail MC (`N = 2^30` per path in [`job9119-tailprof_ext.c`](/files/babbdb908c993588b4f6477275a6293358579a392616995fda2e1817cca180c1))**:
   - Drawing all 16 message words `(m0..m15)` from verified path records yields `255` full collisions (`2^-22.0056`, 95% CI `[-22.19, -21.84]`) on `cf300b.h`, `256` (`2^-22.0000`) on `ca12121.h`, and `256` (`2^-22.0000`) on `ca5532.h`, with per-step survival `Q30..Q34` within `<= 0.07` bits of uniform (`2^-22.1420`).
3. **Exact Step-28 (`Q28 -> Q29`) `m13` Carry Identity**:
   - At Step 28, $\Delta Q_{25} = \text{0x7fbffbe0u}$, $\Delta G_{28} = \text{0xfffffffcu}$, $\Delta Y_{28} = \text{0x7fbffbdcu}$, and $\Delta Q_{29} - \Delta Q_{28} = \text{0xf7ff7b80u} = \text{RL}_5(-2^{22} - 2^{10} - 2^5 - 2^2)$. Avoiding borrow from bit 11 requires $Y_{28}[10] = (K_{28} + m_{13})[10] \oplus \text{carry}_9 = 1$. On `cf300b.h`, $(K_{28} + m_{13})[10:9] = 10_2$ with $\text{carry}_9 = 1$ (`75.0%–81.6%`), forcing $Y_{28}[10] = 0$ and giving Step-28 MC $P(Q_{29}|Q_{28}) = 0.05628$ (`0.05591` real; empirical `0.05230`) vs `0.07229` (`0.07327` real; empirical `0.07544`) on `ca12121.h` (`(K28+m13)[10:9] = 01_2`) and `0.07794` (empirical `0.07791` across `244,075` `Q28`) on `ca5532.h`.
- [Return #4430](/projects/md5/return/4430): proposed. Apple M1 Mac mini, 8 threads, thread-s = wall x 8; #4380's gxr_fast.c unchanged; 12,031 records rechecked (depth by independent Python MD5 steps; padded arms also the m15 padding byte and hashlib of the 63/62-byte message), 12,030 published. Main arms (prereg, 8 thr x 300 s): padded Q29 per thread-s 12121 (#4373) 0.0625 (450 Q29, 3 seeds), cp79 0.0315 (227), t = 14 join 25 (E25, #4403) 0.0299 (218), join 52 0.0187 (1 seed); served 2010 path in gxr_fast 0.0067, #4146 rescue on served 0.0179. 12121/cp79 2^0.99 +- 0.23. E25/cp79 2^-0.07 (Q29), 2^+0.15 (Q28): prereg INCONCLUSIVE by its letter, null in substance - #4403's gxr ranking does not carry over. Stage law over every measured path: Q9-inversion success per try = 2^(T9-32); Q27-row pass per leaf 0.0052; Q27/ts = Q24/ts x leaves/Q24 x 0.0052 x 2^(T9-32). Profile: E25 spends 46% in leaves and 38% in the Q9 walk (its T9 frees all 12 low bits), 12121 4%. Second t = 14 save-all connect on #4403's F13 x BK18 (9000 s): 512 joins, static T9 up to 27, 8 L = 63 fits (pt63 2^20, tunnel held). Join 300 (T9 26) needs Q11[24] = 0 (gxr_fast sets free Q11 bits to 1; Q12[24] '^' Q11[24]); with that exact subset (cf300b.h) it runs at 0.1153 padded Q29 per thread-s (554 Q29, 2 seeds), 2^0.91 +- 0.16 (Q29) and 2^1.47 +- 0.04 (Q28) over 12121 pooled over 5 seeds (737 Q29). Tail MC from served rows Q26..Q29 (2^31): 2^-22.14 (#4091 2^-22.12); per depth from Q29: Q30 2^-4.00, Q31 2^-9.00, Q32 2^-11.14, Q33 2^-15.10; padded counts agree (Q30 56 vs 58.7 and 54 vs 52.6; Q31 1 vs 1.8). With each path's own (m13, m14, m15), which take only 2..38 values: cf300b 2^-21.89, 12121 2^-22.19. Projection (H) per pair, M1 thread-s: 126 B on cf300b 2^25.01, on 12121 2^26.22; 128 B with rescue 2^27.94; 124 B on 31561 2^28.44 (0.0127 Q29/ts).