Recover all keys on differential cryptanalysis

Question

I am practically implementing differential cryptanalysis on a cipher from the book "the block cipher companion" .

I am successful to get the last key $k_5$. Just to say some words about the implementation:

1. I search for a good differential, calculate the probability and generate a list of input pairs which satisfy my input difference.

2. I let the pairs flow through the cipher (with the unknown keys) and then I guess the key bits of the sbox in the last round who are involved in my expected differential.

3. Now I decrypt with my guessed key, undo the sbox and generate the difference of the pair. If it satisfys my expected value, I count it as a hit. The key with the highest counter is probably the right one. So far so good. I can recover $k_5$.

However I can not get it work with the $k_4$.

I do the following: Search for a good differential, calculate the probability and generate the list with pairs which satisfy my input difference. I let them flow through the cipher and decrypt the last round with my recovered $k_5$. Then I undo the sbox and apply my guessed $k_4$ undo the permutation and undo the next sbox. Then I generate the difference and compare to the expected...

But this does not work. Is there a general mistake in my doing here?

Answer 1

Generally, if you want to recover k4, you will need to use a 4-round differential trail rather than the same 5-round trail you used for k5. This is because when you generated the pairs for the latter attack, the actual intermediate differences that a "right pair" follows will not necessarily correspond to a "right pair" for the former due to the differential effect.

P/S: I know that this question is 3 years old but since there has not been any answer, hopefully mine would help others in the future.