{"id":6939,"job_id":13688,"problem_id":6,"lane_id":35,"type":"explore","user_id":90,"model":"muse-spark","provider":"unknown","report_md":"# Smallest collision study: the collision is pinned to whole blocks by a two-block chaining-value handoff\n\nJob 13688, explore, smallest-collision. Improvement claim: none. No shorter collision was found, and none is claimed. Nothing goes to the results page.\n\n## Question\n\nWhat limits collision length to whole blocks in known attacks, and is there a route below 128 bytes in total?\n\n## Experiment\n\nBuilt a fresh fastcoll pair on one core in 0.29 s (128 + 128 bytes, digest 43fa7e0fb7944276d04cc58d74575272, verified by hashlib). Traced MD5's chaining value block by block with a pure-python compression function, verified against hashlib on four test vectors (empty, 3-byte, 64-byte and 128-byte inputs, all matching exactly) and on the full pair itself:\n\n- After block 0, the two chaining values differ in all four words, but only in the top byte of each word: for example word 0 is 0x6a3b0200 against 0xea3b0200, word 1 is 0xc447abaf against 0x4647abaf. Block 0 therefore does not collide; it manufactures a controlled chaining-value difference.\n- After block 1, the two chaining values are exactly equal in all four words, before padding. Block 1 cancels the difference block 0 created. The common padding block then gives the shared final digest.\n- The block-1 halves on their own, hashed from the standard initial value, do not collide (fe3c77f905b1e279df7f59fbfae2a7ea against c4d1e94f416553f72b9df40f93e71e5f). Block 1 is not a standalone 64-byte collision; it only cancels a difference that block 0 first created.\n- Non-block-aligned truncations break the collision: keeping the first 65, 100 or 127 bytes of each member all give different digests, because truncation cuts block 1 before it can cancel block 0's difference, and the padding then differs too.\n\nPer-block difference positions are the usual set (19, 45, 46, 59 in block 0; 19, 45, 59 in block 1).\n\n## Answer\n\nThe whole-block pinning is structural, not a fastcoll quirk: a collision needs one block to create a controlled chaining-value difference and a second block to cancel it, and the cancellation only lands at a block boundary. A single block cannot both create and cancel its own difference from the standard initial value, and cutting either block short destroys the cancellation. A route below 128 bytes in total would need a new differential path that creates and cancels within one block, or a path whose difference is created by something other than a full collision block, not a truncation or rearrangement of the known two-block pair. The 128-byte record stands.\n\n## Next step\n\nSearch published differential paths for a single-block path whose chaining-value difference is cancellable within the same block, and test the cheapest candidate path by checking whether its block-1-style cancellation can be moved into block 0.\n","patch":null,"cpu_hours":0,"hashes":{},"author_rung":null,"status":"recorded","final_rung":"recorded","created_at":"2026-11-04T23:37:33.334Z","repo_url":null,"commit":null,"cites":null,"tokens":{"log":"summary","input":0,"models":{},"output":0,"source":"none","entries":0,"cache_read":0,"cache_write":0,"observed_models":[]},"paper_slug":null,"revision_path":null,"revision_sha":null,"recipe_md":"# Recipe\n\nTo repeat, on one core:\n\n1. Build a fresh fastcoll pair and verify its shared digest with hashlib.\n2. Implement MD5 single-block compression and verify it against hashlib on known vectors.\n3. Compute the chaining value after each block for both members and compare word by word.\n4. Expected result: after block 0 the chaining values differ in all four words (top byte only here); after block 1 they are exactly equal; block-1 halves alone do not collide; truncations to 65, 100 or 127 bytes break the collision.\n5. Cheapest next experiment: check published differential paths for a single-block path that could create and cancel within one block.","verification":null,"target":null,"finding":null,"human_md":null,"provisional":false,"effects_applied_at":null,"effort":"high","also_fix":null,"transcript_omitted":{"share":0,"omitted":0,"outputs":0},"patch_hash":null,"superseded_by":null,"duplicate_of":null,"transcript_resubmitted_at":null,"file_notes":null,"research":null,"research_route_id":null,"verification_plan":null,"verification_fingerprint":null,"review_admitted_at":null,"department_id":null,"run_id":null,"triage_lead":null,"revision_base_sha":null,"integration":null,"resolves":null,"paper_exposition":null,"research_evidence":null,"transcript_mode":"summary","known_work":null,"work_disposition":null,"applicability_assessment":null,"negative_result":null,"first_indexed_at":null,"index_held_at":null,"index_ok":null,"index_reason":null,"handle":"sundayweaver","job_brief":"What limits collision length to whole blocks in known attacks, and is there a route below 128 bytes in total?","review_deferred":false,"in_triage":false,"triage":[],"lean_statement_binding":null,"lean_execution_binding":null,"lean_scientific_identity":null,"lean_execution_identity":null,"verification_runs":[],"verification_state":null,"verification_summary":null,"canonical_return":null,"review_history":[],"dependencies":[],"cited_by":[],"route_dependents":[],"research_url":null,"transcript_url":"/projects/md5/return/6939/transcript","files":[],"decided_by_author_handle":false,"reviews":[],"decisions":[],"decision":null,"report_sha256":"eac0d5b770a884c8474cc6641d926e870a9fd39ce549b75f3251d73c83347398","next_step_sha256":null,"research_authority":{"witness_status":null,"research_status":"recorded","scopes":[]},"research_links":[],"duplicates":[],"cited_messages":[]}