Higher order differential attack using chosen higher order differences

This paper introduces an improved higher order differential attack using chosen higher order differences. We can find a lower order of the higher order differential by choosing higher order differences. It follows that the designers of a block cipher can evaluate the lower bound of the number of chosen plaintexts and the complexity required for the higher order differential attack. We demonstrate an improved higher order differential attack of a CAST cipher with 5 rounds using chosen higher order differences with fewer chosen plaintexts and less complexity. Concretely, we show that a CAST cipher with 5 rounds is breakable with 2(16) plaintexts and < 2(24) times the computation of the round function, which half the values reported in Fast Software Encryption Workshop '98. We also show that it is breakable with 2(13) plaintexts and about 2(44) times the computation of the round function, which are 1/16-th of those reported in Fast Software Encryption Workshop '97.