[Cryptography] Differential cryptanalysis: which differences should I try?

[Pierre Abbat]

I'm differentially cryptanalyzing Wring with small message sizes (3-27 bytes). 
So far I'm doing only single-bit differences of one round (round 0).

A round of Wring consists of four steps:
1. Split the message in three equal parts, with 0, 1, or 2 bytes left over, 
and mix corresponding bits.
2. Pass each byte through one of the three key-dependent S-boxes.
3. Rotate the whole message by the count of one-bits (this is a twisted 
function).
4. Add the round constant bytewise.

The mix3 function is this truth table:
000 -> 000
001 -> 110
010 -> 101
011 -> 100
100 -> 011
101 -> 010
110 -> 011
111 -> 111.
The three bits are in three bytes, one in each part, one stepping up, one 
stepping down, and one jumping around.

I'm thinking of doing two-bit differences, as changing two corresponding bits 
(e.g. bit 3 of bytes 0 and 1 in a 3-byte message) will result, half the time, 
in only one bit changing going into the S-boxes. What other differences should 
I try?

Can you think of other attacks on Wring?

Pierre
-- 
La sal en el mar es más que en la sangre.
Le sel dans la mer est plus que dans le sang.