Return to Answer

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption),

Block cipher is a synonym for Pseudo Random Permutation (PRP) therefore a non-reversible block cipher is not a block cipher as we know it. It would be a Pseudo-Random Function (PRF).

Would it be less or more secure than reversible block ciphers?

While AES as a block cipher resisted attacks for more than 20 years, we have ChaCha20 as a PRF candidate using CTR mode which has resisted attacks since 2008. It is faster than AES in software and has zero cost of key schedule!

it's possible two different inputs with the same key could result in the same output.

Good luck with this collision: ChaCha20 has 512-bit output so you need 2²⁵⁶ random encryptions to see one with 50% probability (see birthday attack).

Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?

Yes; ChaCha20 is the best candidate to show that this makes sense. And any PRF can be used in CTR mode for encryption;

• Is SHA-256 secure as a CTR block cipher?

However, with CTR and irreversible encryption-only block cipher, you could to such a quick access.

Well, yes and no. In this age, we don't advise using Ind-CPA security where the classical modes can only achieve this. To go beyond one needs authenticated encryption such as AES-GCM and ChaCha20-Poly1305. To have authentication one needs a tag, and before the tag verification one should not decrypt and use any part of the ciphertext. If there is a tag error, HALT!

(Title) Would an encryption-only block cipher be useful at all?

As we see, it is no longer a block cipher. There are some benefits;

• No padding oracles if CTR mode or similar is used.
• There may be no need for a key schedule as in ChaCha.
• No need for a separate decryption circuit; that makes it easy to securely implement and audit.
• Using a PRP in CTR mode has a long message distinguisher that restricts the number of encryption blocks due to the PRP-PRF switching lemma. We don't have that with PRFs.

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption),

Block cipher is a synonym for Pseudo Random Permutation (PRP) therefore a non-reversible block cipher is not a block cipher as we know it. It would be a Pseudo-Random Function (PRF).

Would it be less or more secure than reversible block ciphers?

While AES as a block cipher resisted attacks for more than 20 years, we have ChaCha20 as a PRF candidate using CTR mode which has resisted attacks since 2008. It is faster than AES in software and has zero cost of key schedule!

it's possible two different inputs with the same key could result in the same output.

Good luck with this collision: ChaCha20 has 512-bit output so you need $2^{256}$ random encryptions to see one with 50% probability (see birthday attack).

Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?

Yes; ChaCha20 is the best candidate to show that this makes sense. And any PRF can be used in CTR mode for encryption;

• Is SHA-256 secure as a CTR block cipher?

However, with CTR and irreversible encryption-only block cipher, you could to such a quick access.

Well, yes and no. In this age, we don't advise using Ind-CPA security where the classical modes can only achieve this. To go beyond one needs authenticated encryption such as AES-GCM and ChaCha20-Poly1305. To have authentication one needs a tag, and before the tag verification one should not decrypt and use any part of the ciphertext. If there is a tag error, HALT!

(Title) Would an encryption-only block cipher be useful at all?

As we see, it is no longer a block cipher. There are some benefits;

• No padding oracles if CTR mode or similar is used.
• There may be no need for a key schedule as in ChaCha.
• No need for a separate decryption circuit; that makes it easy to securely implement and audit.
• Using a PRP in CTR mode has a long message distinguisher that restricts the number of encryption blocks due to the PRP-PRF switching lemma. We don't have that with PRFs.

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption),

Block ciphers are synonyms for the Pseudo Random Permutation (PRP) therefore a non-reversible block cipher will not be a block cipher as we know it. It will be a Pseudo-Random Function (PRF).

Would it be less or more secure than reversible block ciphers?

While AES as a block cipher resisted attacks for more than 20 years, we have ChaCha20 as a PRF candidate since 2008 that uses CTR mode that resisted attacks since then. Beside it is faster than AES in software and has zero cost of key schedule!

it's possible two different inputs with the same key could result in the same output.

Good luck with this collision, ChaCha20 has 512-bit output that you need $2^{256}$ random encryption to see one with %50 percentage probability ( See birthday attack)

Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?

Yes, As ChaCha20 is the best candidate to show that this makes sense. And, any PRF can be used in CTR mode for encryption;

• Is SHA-256 secure as a CTR block cipher?

However, with CTR and irreversible encryption-only block cipher, you could to such a quick access.

Well, yes and no. In this age, we don't advise using Ind-CPA security where the classical modes can only achieve this. To go beyond one needs authenticated encryption such as AES-GCM and ChaCha20-Poly1305. To have authentication one needs a tag and before the tag verification, one should not decrypt and use any part of the ciphertext. If there is a tag error, HALT!

(Title) Would an encryption-only block cipher be useful at all?

As we see, it is no more a block cipher. There are some benefits;

• No padding oracles if CTR mode or similar is used.
• There may be no need for a key schedule as in ChaCha
• No need for a separate decryption circuit that makes it easy to secure implement and audit.
• Using a PRP in CTR mode has a long message distinguisher that restricts the number of encryption blocks due to the PRP-PRF switching lemma. We don't have with PRFs.

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption),

Block cipher is a synonym for Pseudo Random Permutation (PRP) therefore a non-reversible block cipher is not a block cipher as we know it. It would be a Pseudo-Random Function (PRF).

Would it be less or more secure than reversible block ciphers?

While AES as a block cipher resisted attacks for more than 20 years, we have ChaCha20 as a PRF candidate using CTR mode which has resisted attacks since 2008. It is faster than AES in software and has zero cost of key schedule!

it's possible two different inputs with the same key could result in the same output.

Good luck with this collision: ChaCha20 has 512-bit output so you need 2²⁵⁶ random encryptions to see one with 50% probability (see birthday attack).

Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?

Yes; ChaCha20 is the best candidate to show that this makes sense. And any PRF can be used in CTR mode for encryption;

• Is SHA-256 secure as a CTR block cipher?

However, with CTR and irreversible encryption-only block cipher, you could to such a quick access.

Well, yes and no. In this age, we don't advise using Ind-CPA security where the classical modes can only achieve this. To go beyond one needs authenticated encryption such as AES-GCM and ChaCha20-Poly1305. To have authentication one needs a tag, and before the tag verification one should not decrypt and use any part of the ciphertext. If there is a tag error, HALT!

(Title) Would an encryption-only block cipher be useful at all?

As we see, it is no longer a block cipher. There are some benefits;

• No padding oracles if CTR mode or similar is used.
• There may be no need for a key schedule as in ChaCha.
• No need for a separate decryption circuit; that makes it easy to securely implement and audit.
• Using a PRP in CTR mode has a long message distinguisher that restricts the number of encryption blocks due to the PRP-PRF switching lemma. We don't have that with PRFs.

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption),

Block ciphers are synonyms for the Pseudo Random Permutation (PRP) therefore a non-reversible block cipher will not be a block cipher as we know it. It will be a Pseudo-Random Function (PRF).

Would it be less or more secure than reversible block ciphers?

While AES as a block cipher resisted attacks for more than 20 years, we have ChaCha20 as a PRF candidate since 2008 that uses CTR mode that resisted attacks since then. Beside it is faster than AES in software and has zero cost of key schedule!

it's possible two different inputs with the same key could result in the same output.

Good luck with this collision, ChaCha20 has 512-bit output that you need $2^{256}$ random encryption to see one with %50 percentage probability ( See birthday attack)

Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?

Yes, As ChaCha20 is the best candidate to show that this makes sense. And, any PRF can be used in CTR mode for encryption;

• Is SHA-256 secure as a CTR block cipher?

However, with CTR and irreversible encryption-only block cipher, you could to such a quick access.

Well, yes and no. In this age, we don't advise using Ind-CPA security where the classical modes can only achieve this. To go beyond one needs authenticated encryption such as AES-GCM and ChaCha20-Poly1305. To have authentication one needs a tag and before the tag verification, one should not decrypt and use any part of the ciphertext. If there is a tag error, HALT!

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption),

Block ciphers are synonyms for the Pseudo Random Permutation (PRP) therefore a non-reversible block cipher will not be a block cipher as we know it. It will be a Pseudo-Random Function (PRF).

Would it be less or more secure than reversible block ciphers?

While AES as a block cipher resisted attacks for more than 20 years, we have ChaCha20 as a PRF candidate since 2008 that uses CTR mode that resisted attacks since then. Beside it is faster than AES in software and has zero cost of key schedule!

it's possible two different inputs with the same key could result in the same output.

Good luck with this collision, ChaCha20 has 512-bit output that you need $2^{256}$ random encryption to see one with %50 percentage probability ( See birthday attack)

Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?

Yes, As ChaCha20 is the best candidate to show that this makes sense. And, any PRF can be used in CTR mode for encryption;

• Is SHA-256 secure as a CTR block cipher?

However, with CTR and irreversible encryption-only block cipher, you could to such a quick access.

Well, yes and no. In this age, we don't advise using Ind-CPA security where the classical modes can only achieve this. To go beyond one needs authenticated encryption such as AES-GCM and ChaCha20-Poly1305. To have authentication one needs a tag and before the tag verification, one should not decrypt and use any part of the ciphertext. If there is a tag error, HALT!

(Title) Would an encryption-only block cipher be useful at all?

As we see, it is no more a block cipher. There are some benefits;

• No padding oracles if CTR mode or similar is used.
• There may be no need for a key schedule as in ChaCha
• No need for a separate decryption circuit that makes it easy to secure implement and audit.
• Using a PRP in CTR mode has a long message distinguisher that restricts the number of encryption blocks due to the PRP-PRF switching lemma. We don't have with PRFs.