I recently implemented AES block cipher, encryption side only, to be used in QUIC parsing (QUIC uses GCM mode). There are other modes than GCM that use only encryption: for example CTR, OFB, and CFB.
When implementing the AES cipher encryption side, it occurred to me how everything is done there has to be reversible, so the bit-mixing operations you do can't be arbitrary, they have to be carefully constructed in such a manner that you can implement the decryption side.
Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption), to be used only in GCM, CTR, OFB, and CFB modes? Would it be less or more secure than reversible block ciphers?
I can imagine at least one benefit of such an irreversible block cipher: it could maybe mix bits more thoroughly than a reversible block cipher.
However, there might be some drawbacks too: if the cipher is irreversible, it's possible two different inputs with the same key could result in the same output. However, an attacker without possession of the key can't probably guess which inputs would result in the same output.
Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers?
A stream cipher could be thought of as such an irreversible system, but you can't usually quickly decrypt a block in the middle of a long ciphertext without running the cipher from the start to that point if using a true stream cipher. However, with CTR and irreversible encryption-only block cipher, you could do such quick access.