rust-ahash: aHash 0.8.12 as tested by SMHasher3 (hashes/rust-ahash.cpp); AES backend: AES-NI rust_ahash SMHasher3 verification 0x3BF4383B (registered 0x3BF4383B) OK rust_ahash_fb SMHasher3 verification 0x53C9F167 (registered 0x53C9F167) OK N = 2^24 random secrets per model, rng seed 1 == pair A_2: rust_ahash (AES path), 56-byte messages m1 = 22313233343536373839263b3c3d3e3f407b42404445464748494a4b4c4d4e4f0df97e025c5d5e5f606162636465666768696a6b6c6d6e6f m2 = 1f313233343536373839343b3c3d3e3f406d422f4445464748494a4b4c4d4e4fff098d055c5d5e5f606162636465666768696a6b6c6d6e6f xor= 3d0000000000000000001200000000000016006f000000000000000000000000f2f0f3070000000000000000000000000000000000000000 mechanism: 3-S-box trail plus shuffled-addition cancellation; selected A_2, rate about 2^-19.376 explicit colliding secret: k0..k3 = ec6baf58f9a18793 b5e2ee792117d0ff 893c786e1e8196a8 a4edbe691f677fb2 H(m1) = 21a01e6ddf40c84a H(m2) = 21a01e6ddf40c84a COLLIDE model rs4 (four uniform keys k0..k3) : collisions/N = 27/2^24 = 2^-19.25 3.7 s; first colliding secret: k0..k3 = dd0281defea91a8b db787cda849e9216 ca0bcb3d58d45ccb 222f60bbfadaad3a H(m1) = H(m2) = 67b7ef14bd9c8be8 model smh (one uniform seed, k_j = PI2[j]^seed): collisions/N = 25/2^24 = 2^-19.36 3.7 s; first colliding secret: seed = c4d3c236a13ed30e, k0..k3 = 81fbe3d099eec079 7a87a4f995d7df62 047feb81684283d3 fb5717831479da19 H(m1) = H(m2) = c087948c9e4df11d == pair A_1: rust_ahash (AES path), 56-byte messages m1 = 3f313233343536373839283b3c3d3e3f408042804445464748494a4b4c4d4e4f7b79f80c5c5d5e5f606162636465666768696a6b6c6d6e6f m2 = 4a3132333435363738391f3b3c3d3e3f407342774445464748494a4b4c4d4e4f848205025c5d5e5f606162636465666768696a6b6c6d6e6f xor= 7500000000000000000037000000000000f300f7000000000000000000000000fffbfd0e0000000000000000000000000000000000000000 mechanism: 3-S-box trail plus shuffled-addition cancellation; documented alternate; see README explicit colliding secret: k0..k3 = 561a2123bb769797 028005bfb096b815 5a613aeef8583eaf 7dfa5de284bf1593 H(m1) = 7b94bae5e59ffbcf H(m2) = 7b94bae5e59ffbcf COLLIDE model rs4 (four uniform keys k0..k3) : collisions/N = 24/2^24 = 2^-19.42 3.7 s; first colliding secret: k0..k3 = 01cd0de17ba57a8b eee41d2099e5419a d7ebf9f5bfc622a8 ed7608254d194fff H(m1) = H(m2) = c615a5b2ba4e9637 model smh (one uniform seed, k_j = PI2[j]^seed): collisions/N = 28/2^24 = 2^-19.19 3.7 s; first colliding secret: seed = 491fa677c7cc239c, k0..k3 = 0c378791ff1c30eb f74bc0b8f3252ff0 89b38fc00eb07341 769b73c2728b2a8b H(m1) = H(m2) = bceec8ee4727edae == pair B_0: rust_ahash (AES path), 64-byte messages m1 = 40313233343536374239253b3c3d3e804081420944454647481f4a4a4c4d4e4faf6a432e5c5d5e5f606162636465666768696a6b6c6d6e6f7071727374757677 m2 = 40313233343536371c39253b3c3d3e6a408142094445464748664a334c4d4e4fd581fc435c5d5e5f606162636465666768696a6b6c6d6e6f7071727374757677 xor= 00000000000000005e000000000000ea000000000000000000790079000000007aebbf6d00000000000000000000000000000000000000000000000000000000 mechanism: 3-S-box trail plus shuffled-addition cancellation; documented alternate; see README explicit colliding secret: k0..k3 = b6c1ee01221b4682 4cc42b390e71451e 1d6e6530e99a4820 01bb5610e64af968 H(m1) = 032b6f3a6667dda4 H(m2) = 032b6f3a6667dda4 COLLIDE model rs4 (four uniform keys k0..k3) : collisions/N = 28/2^24 = 2^-19.19 3.7 s; first colliding secret: k0..k3 = 38e9089944cc25c6 a4f3a47d01de47cf 5b849bccd7203549 b1530811a6610f4b H(m1) = H(m2) = 63863e90718b24f0 model smh (one uniform seed, k_j = PI2[j]^seed): collisions/N = 22/2^24 = 2^-19.54 3.7 s; first colliding secret: seed = 7f4154246a52e943, k0..k3 = 3a6975c25282fa34 c11532eb5ebbe52f bfed7d93a32eb99e 40c58191df15e054 H(m1) = H(m2) = 55d778b836ceec14 == pair A: rust_ahash (AES path), 56-byte messages m1 = 40313233343536373839253b3c3d3e3f408142094445464748494a4b4c4d4e4f8d896d065c5d5e5f606162636465666768696a6b6c6d6e6f m2 = 3e313233343536373839403b3c3d3e3f405e42204445464748494a4b4c4d4e4f727290085c5d5e5f606162636465666768696a6b6c6d6e6f xor= 7e00000000000000000065000000000000df0029000000000000000000000000fffbfd0e0000000000000000000000000000000000000000 mechanism: 3-S-box differential trail through hash_in: the byte differences in block 1 (bytes 0,10) are chosen so that InvShiftRows puts them in one column and InvMixColumns of the inverse-S-box outputs (DDT 4/256 each) leaves one byte, which block 2 cancels except for one byte (DDT 2/256) that block 3 cancels; the sum lane cancels additively through the shuffle. Predicted 4/256 * 4/256 * 2/256 * (carry factor ~2^-0.7) = 2^-19.7; unconditional over the keys. explicit colliding secret: k0..k3 = 711096b41e1b7d99 59af3b7ae3b7d595 d2fb75eb5658a771 5a0f91d8ed1ffe38 H(m1) = 45ef7682d72b19b6 H(m2) = 45ef7682d72b19b6 COLLIDE model rs4 (four uniform keys k0..k3) : collisions/N = 26/2^24 = 2^-19.30 3.7 s; first colliding secret: k0..k3 = 26f10121bf2cf5bb 3d32a8e232ec9e5e 6a6f9182eaa86b6d 0d8f8a1098f9d71f H(m1) = H(m2) = b06f3670babedffb model smh (one uniform seed, k_j = PI2[j]^seed): collisions/N = 11/2^24 = 2^-20.54 3.7 s; first colliding secret: seed = f04f16d5122a6a3a, k0..k3 = b56737332afa794d 4e1b701a26c36656 30e33f62db563ae7 cfcbc360a76d632d H(m1) = H(m2) = 2dc0adbf4570e056 == pair B: rust_ahash_fb (fallback path), 16-byte messages m1 = 0123456789abcdef0011223344556677 m2 = fedcba9876543210ffeeddccbbaa9988 xor= ffffffffffffffffffffffffffffffff mechanism: complement both words of a one-block message: the single folded multiply sees (~a)(~b) = a*b + (a+b+1) - 2^64*(a+b+2) mod 2^128 with a = w0^k2, b = w1^k3, so the low and high halves of the product move by nearly opposite amounts and lo^hi cancels for about 2^-26 of the keys (panel: 55/2^32 = 2^-26.2; below the resolution of a 2^24 run, see README). explicit colliding secret: k0..k3 = 64721c4a2c381d36 6b5648524261eaab b59e91f82c7d1e12 94c815ea45f3d238 H(m1) = 82d7a0f7495678e3 H(m2) = 82d7a0f7495678e3 COLLIDE model rs4 (four uniform keys k0..k3) : collisions/N = 0/2^24 (none observed in 2^24 trials; no population bound) 0.2 s; no collision found in this run model smh (one uniform seed, k_j = PI2[j]^seed): collisions/N = 0/2^24 (none observed in 2^24 trials; no population bound) 0.1 s; no collision found in this run