Optimized χ^2 attack against RC6

In this paper, we make progress on X 2 -attack by introducing the optimization. We propose three key recovery attacks against RC6 without post-whitening, and apply these three key recovery algorithms to RC6. We discuss their differences and optimization and thus our best attack can break 16-round RC6 without pre-whitening with 128-bit key (resp. 16-round RC6 with 192-bit key) by using 2 117.84 (resp. 2 122.84 ) chosen plaintexts with a success probability of 95% (resp. 90%). As far as the authors know, this is the best result of attacks to RC6.