differential cryptanalysis cipher for the final round I have a problem to find the sub-key.
The  system is…

For each round, we make the following stage:

We add the round key $K_i$.

Substitution : we have 8 blocks of 4 bits, and an S-box takes each block.
S = [7,3,6,1,13,9,10,11,2,12,0,4,5,15,8,14]

Permutation : circular shift of 2 to the right.



I choose the differential $\Delta(1 \implies 4)$ because after the permutation the differential trail is $\Delta(1 \implies 4 \implies 1)$.
I coded in C, the algorithm to find the $K_5$, the sub key after 5 rounds.
plainText[m] is a random message and plainText[m+1] is plainText[m] ^ 1(difference).
 0000   0000   0000   0000   0000   0000   0000   0001
------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 0000   0000   0000   0000   0000   0000   0000   0100
                                                    \
 0000   0000   0000   0000   0000   0000   0000   0001
------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 0000   0000  0000    0000   0000   0000   0000   0100

I tested the function of encryption and decryption, it operates normally.
The problem is that I get a uniform array, because when I decrypted message, the differential trail is good for all the keys while normally this should not always be the case for any key for a message.
For example:
plaintText[i]=7584 and plaintText[i+1]=7585(7584 XOR 1).

In my code, for key=0,u=69b900ca and up=645100ca and tmp=2b131dd4 so beta=4. For key=1,u=69b900ca and up=645100cb and beta=4. The problem is that for any key, I get the same beta.
Remark: The round function of your toy cipher is the following.

       |
K ---&gt; + 
       |
    -------
    |  S  |
    -------
       |
      &gt;&gt; 2
       |

  
  Hence in the last round, the shift and S-box are useless (because invertible hence do not add security) which is why in a SPN scheme the key addition at the end is preferred.




I did a quick check your S-box differentials:

    |   0   1   2   3   4   5   6   7   8   9  10  11  12  13  14  15 
---------------------------------------------------------------------
  0 |  16                                                             
  1 |       2           6       2   2           2               2     
  2 |       4   6                   2   2                   2         
  3 |               2       2   6   2               2   2             
  4 |               2               2   2       8       2             
  5 |                                       2       2   2   4   6     
  6 |           2           2           4       2   4       2         
  7 |       2           2                   2           6           4 
  8 |           2           6   4       2                           2 
  9 |       4   4   2   2                           2   2             
 10 |                   4   2       6                       2       2 
 11 |       2       8       2                   2               2     
 12 |           2           2                   2       2       2   6 
 13 |       2                   2       4   2       4           2     
 14 |               2               2   2                   6   2   2 
 15 |                   2       2          10       2                 
0011 =&gt; 0110 : 6 / 16
0010 =&gt; 0010 : 6 / 16
0101 =&gt; 1110 : 6 / 16
0001 =&gt; 0100 : 6 / 16
0100 =&gt; 1010 : 8 / 16
1100 =&gt; 1111 : 6 / 16
0111 =&gt; 1100 : 6 / 16
1010 =&gt; 0111 : 6 / 16
1011 =&gt; 0011 : 8 / 16
1110 =&gt; 1101 : 6 / 16
1111 =&gt; 1001 : 10 / 16
1000 =&gt; 0101 : 6 / 16


Hence the chosen one $\Delta(0001 \implies 0100)$ holds with a probability of $6/16$.
However you forgot that you work with a 32bits block cipher:
Meaning that with your chosen difference ($1$), will switch of to the next S-box after each round :

 0000   0000   0000   0000   0000   0000   0000   0001
------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 0000   0000   0000   0000   0000   0000   0000   0100
                                                   \
                                                    \     ROUND 1
 0000   0000   0000   0000   0000   0000   0000   0001
------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 0000   0000   0000   0000   0000   0000   0000   0100
                                                   \
                                                    \     ROUND 2
 0000   0000   0000   0000   0000   0000   0000   0001
------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 0000   0000   0000   0000   0000   0000   0000   0100
                                                   \
                                                    \     ROUND 3
 0000   0000   0000   0000   0000   0000   0000   0001
------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 0000   0000   0000   0000   0000   0000   0000   0100
 ||||   ||||   ||||   ||||   ||||   ||||   ||||   ||||
 0000   0000   0000   0000   0000   0000   0000   ????
 \                                                \\\\
 \\                                                \\\  ROUND 4
 ??00   0000   0000   0000   0000   0000   0000   00?? &lt;-This is where you attack

------ ------ ------ ------ ------ ------ ------ ------
| S1 | | S2 | | S3 | | S4 | | S5 | | S6 | | S7 | | S8 |
------ ------ ------ ------ ------ ------ ------ ------
 ????   ????   ????   ????   ????   ????   ????   ????  Round 5


It is also note worthy that this differential holds with a probability of $3^4/8^4 = 81/4096 \approx 2\%$.



I did the attack when the key addition is at the end. I'm trying to make it works when the key addition is at the begining. WIP