Higher-order differential cryptanalysis