Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In this presentation at the 30c3 (long but extremely interesting and well-documented), Jacob Appelbaum gave this verbal advice (circa 43'30"):

look for the constants that you might find in RC6

I'm trying to make sense out of that; my problem is, there are very few constants that I could find in the description of RC6. Any idea?

share|improve this question
I only see constants $P$ and $Q$ in the key schedule and in the paper they are descibed as nothing up my sleeve, i.e.,derived from $e$ and the the Golden ratio, but I didn't check that. – DrLecter Dec 30 '13 at 21:54
@DrLecter: I missed these constants on first reading! That could well be the answer, or at least part of it. – fgrieu Dec 30 '13 at 22:28
I just checked the hex values for $P$ and $Q$ and they are correct as given in the paper as $P=\tt B7E15163$ and $Q=\tt 9E3779B9$ when taking rounding into account :/ – DrLecter Dec 31 '13 at 15:29
up vote 2 down vote accepted

The Key schedule appendix of the RC6 paper (Rivest et al.) defines two arbitrary constants in hexadecimal notation. They also appear in RC5.

  • $P_{32} = \tt{B7E15163}$
  • $Q_{32} = \tt{9E3779B9}$

Be aware that the binary coding of these constants will vary based on the endian-ness of the computer architecture.

There seems to be nothing 'special' about these constants in relation to the construction of the RC6 algorithm. They can be replaced with any random value, producing an incompatible variant of RC6 with presumably identical security properties, and the authors make note of this. (The 'official' constants were chosen based on open criteria, described in the paper, in order to dispel any notion that they induce a back door.) Thus a serious search for RC6 would include RC6-alikes and look for algorithm structure rather than constants.

There are no other arbitrary numeric constants defined in RC6, unless you would go so far as to consider the number of rounds etc. as such.

By the way, Appelbaum's talk wasn't "well documented" enough to provide any justification for this RC6 hunt. Typically of Appelbaum, he takes the position, "Trust me, I've seen the secret documents." Sounds like some senators I know.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.