I'm wondering if implementing only the AES decryption can reduce the hardware cost? And does anybody have some examples of the cost (speed, size) of hardware AES implementation?
In practice, AES encryption mostly use CTR mode or some authenticated encryption, and in these the block cipher itself is only used for encryption. There is thus often no need to implement AES decryption in hardware.
We can always remove features from hardware circuitry. Implementing only the AES encryption sizably reduce the hardware cost (compared to also implementing decryption), but implementing only decryption saves much less (especially for cost-optimized rather than speed-optimized designs), because: