[rwth-security] First practical SHA-256 collision for 31 steps