Optimized χ2-attack against RC6

Abstract

In this paper, we make progress on χ2-attack by introducing the optimization. We propose three key recovery attacks against RC6 without post-whitening, and apply these three key recovery algorithms to RC6. We discuss their differences and optimization and thus our best attack can break 16-round RC6 without pre-whitening with 128-bit key (resp. 16-round RC6 with 192-bit key) by using 2117.84 (resp. 2122.84) chosen plaintexts with a success probability of 95% (resp. 90%). As far as the authors know, this is the best result of attacks to RC6. © Springer-Verlag Berlin Heidelberg 2003.