Success probability in chi - square attacks

Knudsen and Meier applied the χ-attack to RC6. This attack is one of the most effective attacks for RC6. The χ-attack can be used for both distinguishing attacks and for key recovery attacks. Up to the present, theoretical analysis of χ-attacks, especially the relation between a distinguishing attack and a key recovery attack, has not been discussed. In this paper, we investigate the theoretical relation between the distinguishing attack and the key recovery attack for the first time, and prove the theorem to evaluate the success probability of a key recovery attack by using the results of a distinguishing attack. We also demonstrate the accuracy to χ-attack on RC5-64 and RC6 without post-whitening by comparing the implemented results.