Theoretical Analysis of χ² Attack on RC6

In this paper, we give a theoretical analysis of χ² attack proposed by Knudsen and Meier on the RC6 block cipher. To this end, we propose a method of security evaluation against χ² attack precisely including key dependency by introducing a method "Transition Matrix Computing." Previously, no theoretical security evaluation against χ² attack was known, it has been done by computer experiments. We should note that it is the first result concerning the way of security evaluation against χ² attack is shown theoretically.