Higher-order differential attack
A differential attack that looks at higher-order differences of ciphertext across a set of plaintexts.
Lars Knudsen introduced the method in 1994 in a paper on truncated differentials. The idea rests on the fact that the k-th order derivative of a function of algebraic degree d is zero once k > d. If a round has low algebraic degree, an attacker can draw conclusions from a surprisingly small set of plaintexts.
The method works best against ciphers with low algebraic degree, such as simple S-boxes, and is a routine tool when evaluating lightweight ciphers. Choosing an S-box of high degree makes the attacker's job considerably harder.