First practical SHA-256 collision for 31 steps. fse2024