Would an encryption-only block cipher be useful at all?

Question

I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB.

When implementing the AES cipher encryption side, it occurred to me how everything is done there has to be reversible, so the bit-mixing operations you do can't be arbitrary, they have to be carefully constructed in such a manner that you can implement the decryption side.

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption), to be used only in GCM, CTR, OFB, and CFB modes? Would it be less or more secure than reversible block ciphers?

I can imagine at least one benefit of such an irreversible block cipher: it could maybe mix bits more thoroughly than a reversible block cipher.

However, there might be some drawbacks too: if the cipher is irreversible, it's possible two different inputs with the same key could result in the same output. However, an attacker without possession of the key can't probably guess which inputs would result in the same output.

Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?

A stream cipher could be thought of as such an irreversible system, but you can't usually quickly decrypt a block in the middle of a long ciphertext without running the cipher from the start to that point if using a true stream cipher. However, with CTR and irreversible encryption-only block cipher, you could do such quick access.

Answer 1

Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption),

Block cipher is a synonym for Pseudo Random Permutation (PRP) therefore a non-reversible block cipher is not a block cipher as we know it. It would be a Pseudo-Random Function (PRF).

Would it be less or more secure than reversible block ciphers?

While AES as a block cipher resisted attacks for more than 20 years, we have ChaCha20 as a PRF candidate using CTR mode which has resisted attacks since 2008. It is faster than AES in software and has zero cost of key schedule!

it's possible two different inputs with the same key could result in the same output.

Good luck with this collision: ChaCha20 has 512-bit output so you need $2^{256}$ random encryptions to see one with 50% probability (see birthday attack).

Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?

Yes; ChaCha20 is the best candidate to show that this makes sense. And any PRF can be used in CTR mode for encryption;

• Is SHA-256 secure as a CTR block cipher?

However, with CTR and irreversible encryption-only block cipher, you could to such a quick access.

Well, yes and no. In this age, we don't advise using Ind-CPA security where the classical modes can only achieve this. To go beyond one needs authenticated encryption such as AES-GCM and ChaCha20-Poly1305. To have authentication one needs a tag, and before the tag verification one should not decrypt and use any part of the ciphertext. If there is a tag error, HALT!

(Title) Would an encryption-only block cipher be useful at all?

As we see, it is no longer a block cipher. There are some benefits;

• No padding oracles if CTR mode or similar is used.
• There may be no need for a key schedule as in ChaCha.
• No need for a separate decryption circuit; that makes it easy to securely implement and audit.
• Using a PRP in CTR mode has a long message distinguisher that restricts the number of encryption blocks due to the PRP-PRF switching lemma. We don't have that with PRFs.