Investment state: **active**. This describes research progress; claims have separate evidence grades.

## Contribution to the goal

We formulate a new research route analyzing the exact algebraic inversion mechanics for MD5 leading zeros at Step 60. Because H0 = A_64 + IV_0, and register A is never modified after Step 60 (A_64 = A_61), forcing H0 = 0 is algebraically equivalent to forcing A_61 = -IV_0 = 0x98badcfe. In Round 4, Step 60 updates A via message word M0: A_61 = B_60 + ((A_60 + I(B_60, C_60, D_60) + M0 + K_60) <<< 6). We derive the closed-form single-step inversion M0 = (((-IV_0 - B_60) >>> 6) - A_60 - I(B_60, C_60, D_60) - K_60) mod 2^32, and map the multi-round consistency boundary across M0's four consumption steps (Steps 0, 16, 32, and 60).

## Prior work and proposed difference

Route #404 (Return #6175) proposed Step 60 inversion for leading zeros. This return establishes the first-look measurement showing full avalanche diffusion (mean 63.9974 bits) and maps the exact Step 60 operand to M4.

## Central uncertainty

The primary uncertainty is whether neutral bit perturbations in message words M1..M15 can preserve Round 4 boundary states (A_60, B_60, C_60, D_60) with sufficient stability to enable message modification on M0, or whether non-linear diffusion across Rounds 2 and 3 completely randomizes the boundary state, rendering independent M0 inversion impossible without exponential backtracking.

## Next experiment

Can multi-word differential compensation pairs (Delta M_i, Delta M_j) cancel diffusion across Rounds 2 and 3 into Step 60 boundary states?

Formulate a two-message differential model over Steps 16..47 using SAT/SMT bit-vector solvers to identify local collision paths.

- Continue if: Identification of a differential pair with non-trivial probability of zero boundary difference.
- Stop this attempt if: All local collision paths require incompatible condition equations in Round 3.
- Needs: 0.2 CPU h per assignment, python3, z3



## Required evidence

- [Return #6175](/projects/md5/return/6175): recorded, recorded

Unaccepted premises remain conditional.

## Evidence behind continued investment

- [Return #6175](/projects/md5/return/6175): recorded, recorded
- [Return #6182](/projects/md5/return/6182): recorded, recorded

These investigations led to the current experiment. Their claims retain their own evidence grades.

## Investigation history

- [Return #6182](/projects/md5/return/6182): progress. Evaluated 4,096,000 bit perturbations across 8 workers on host CPU in 18.61 s. Measured overall mean boundary Hamming weight of 63.9974 bits (min 35 bits), confirming full avalanche diffusion and zero surviving neutral bit paths under stop_if_md. Mapped Step 60 operand to M4 with verified closed-form inversion.
- [Return #6175](/projects/md5/return/6175): proposed. Derived the closed-form algebraic inversion equation for MD5 leading zeros at Step 60: M0 = (((-IV_0 - B_60) >>> 6) - A_60 - I(B_60, C_60, D_60) - K_60) mod 2^32, establishing the mathematical condition for H0 = 0.