What kind of ciphers does not depend on order of operation?

Question

What kind of cipher does not depend on order of operation ?

For Instance if we have two operations encryption Enc(m,k), decryption Dec(m,k) and some message m.

For which ciphers the following is true:

Dec ( Enc (m, k), k ) = Enc ( Dec (m,k),k )

I suppose ciphers in counters mode where Enc() and Dec() are identical operations provide such property.

What about AES_CBC ? ChaCha20 ? Camellia ?

Answer 1

What kind of cipher does not depend on order of operation?

Any form of PRP (block cipher) or PRG (stream cipher).

I suppose ciphers in counters mode where Enc() and Dec() are identical operations provide such property.

CTR mode transforms a block cipher (PRP) into a stream cipher (PRG).

What about AES_CBC ? ChaCha20 ? Camellia ?

CBC would pass your test but it'll xor the plaintext (instead of ciphertext) into the next block's ciphertext (instead of plaintext). This might weaken it. I'm not sure. You'll have to check the proofs if you want to invert CBC. PCBC would be probably safe (or safer than inverted CBC?) as it xors the plaintext and ciphertext into the ciphertext (normally plaintext) of the next block.

Chacha20 is a PRG where $\text{Enc} = \text{Dec}$, so it'll pass the test.

Camellia is a block cipher, just like AES.

---

Better questions:

Which modes support this without weakening it?

This is safe at least with CTR, OFB and wide-PRPs. Or even ECB, but you shouldn't use that anyway!

You can test all modes and try to prove or disprove their inverse-safety. But it is generally safer to use the right function for the named task.

Why do you need to invert these functions?

I see at least one use for this: to hide the encrypt vs decryption direction in onion routing networks like HORNET or Tor. In this case the relays would use the cheaper function (if one is cheaper). This use case relies on the stronger semantics provided by a wide-PRP. For more information on this see Onion-AE.