{
  "id": "collision-frontier-v5",
  "version": 5,
  "attack_class": "ordinary-collision",
  "time_unit": "target-compressions",
  "score": "log2(total charged time)",
  "direction": "lower-is-better",
  "minimum_success_probability": 0.39,
  "computation_model": "Classical probabilistic 256-bit word RAM. One selected-round target compression or sponge permutation costs one unit; every other primitive word operation costs 1/C units, where C is the selected target reference_operation_cost. BLAKE3 must charge all chunk/parent/root compressions. A field-specific model is required before Poseidon activation.",
  "primitive_operations": [
    "256-bit load or store",
    "addition/subtraction modulo 2^256",
    "bitwise AND/OR/XOR/NOT",
    "shift or rotation",
    "comparison",
    "conditional branch",
    "independent uniform random 256-bit word"
  ],
  "total_time_includes": [
    "preprocessing",
    "message and differential construction",
    "randomness",
    "all trials including failures",
    "sorting and lookup",
    "collision checking",
    "restart and success amplification"
  ],
  "memory_includes": [
    "code",
    "nonuniform advice",
    "precomputed data",
    "messages",
    "working state",
    "tables",
    "randomness retained in memory"
  ],
  "probability_space": "Fresh independent algorithmic coins, fixed selected target. A seeded experiment is reproducibility evidence; its deterministic seed expansion does not establish independent ideal random coins for the full attack.",
  "heuristics": "Explicitly declared, evidence-linked heuristic premises are adjudicated under paired-lanes-v1. Epistemic judgment of a premise is distinct from algorithmic success probability.",
  "nominal_reference": "The organizer nominal exponent is 64 for MD5, 80 for SHA-1, and 128 for selected 256-bit modern targets. This is a reference security claim, not a qualified baseline or a guarantee of an exact implementation score. All construction work remains charged in compression equivalents; memory bytes are reported separately.",
  "nonuniform_advice": "A stored precomputed collision is not a cheap construction. All construction/preprocessing and advice must be accounted for, including any search omitted from the submitted program.",
  "quantum": "Quantum algorithms are out of scope.",
  "score_metric": "timeLog2",
  "memory_scoring": "Required and reviewed as a metric only; no scalar contribution and no tie-break.",
  "parallel_computation": "Charge total work summed across all processors, not parallel wall-clock latency.",
  "reference_operation_costs": {
    "md5-s63": 843,
    "md5-s64": 856,
    "sha1-r79": 1957,
    "sha1-r80": 1982,
    "sha256-r31": 2140,
    "sha256-r32": 2224,
    "sha3-256-r5": 1355,
    "keccak800-r5": 1355,
    "sha3-256-r6": 1626,
    "keccak800-r6": 1626,
    "blake3-r1": 222,
    "blake3-r2": 430
  }
}