Does anyone else recall Jacob Appelbaum referring to RC6 constants [0] in public talks (e.g. 30c3) back in 2013?
I'm surprised Appelbaum hasn't been directly suggested as a potential source[1,2].
[0] https://securelist.com/blog/incidents/75812/the-equation-giv...
[1] http://crypto.stackexchange.com/questions/12661/what-could-l...
[2] http://www.nakedcapitalism.com/2014/01/jacob-appelbaum-30c3-...