Differential cryptanalysis in "The Block Cipher Companion" I am practically implementing a differential cryptanalysis on a cipher which can be found in the book "The Block Cipher Companion". Following image shows the cipher:



In Fig. 6.10 (page 126) there are some evaluations to the probabilities of success to correctly restore the bits 4-8 of k5 depending on a given count of choose messages. I try to compare my implementation with the given results. My problem currently is, that my implementation does not really compare good to the given results. For example: In the book they say, with 32 choosen messages, they restore the bits of k5 with a probability of 64% in 100 cases. I get roughly 28% with my implementation. So may be there is some problem with my implementation or the setup of the tests are a bit different. Is here anybody who implemented the differential cryptanalysis for the cipher in the book "The Block Cipher Companion"? Or does somebody has some test vectors?
I haven't studied this in detail, but the authors seem to give quite a comprehensive presentation of the differential attack.

Please note that this cipher is essentially the same as the one in Heys' Tutorial on Linear and Differential Cryptanalysis (easily found online by a google search) but the Sbox is different.

I have had students implement that attack successfully. So you can use that text as an extra reference while you are trying to sort things out.

In fact the authors themselves of the Block Cipher Companion state, on page 121, that 


  The probability of
  the characteristic we have identified could be too small to effectively distinguish the
  correct key information.