A new approach to chi^2 cryptanalysis of block ciphers

The main contribution of this paper is a new approach to χ2 analyses of block ciphers in which plaintexts are chosen in a manner similar to that in a square/saturation attack. The consequence is a faster detection of χ2 correlation when compared to conventional χ2 cryptanal- ysis. Using this technique we (i) improve the previously best-known χ2 attacks on 2- and 4-round RC6, and (ii) mount the first attacks on the MRC6 and ERC6 block ciphers. The analyses of these fast primitives were also motivated by their low diffusion power and, in the case of MRC6 and ERC6, their large block sizes, that favour their use in the construction of compression functions. Our analyses indicate that up to 98 rounds of MRC6 and 44 rounds of ERC6 could be attacked.