A Statistical Attack on RC6.
H. Gilbert, H. Handschuh, S. Vaudenay, and A. Joux.

This paper details the attack on RC6 which was announced in a report published in the proceedings of the second AES candidate conference (March 1999). Based on an observation on the RC6 statistics, we show how to distinguish RC6 from a random permutation and to recover the secret extended key for a fair number of rounds.