> Would it make any sense to design an irreversible block cipher where the encryption side wouldn't be reversible (and thus you can't implement decryption), Block cipher is a synonym for Pseudo Random Permutation (PRP) therefore a non-reversible block cipher is not a block cipher as we know it. It would be a Pseudo-Random Function (PRF). > Would it be less or more secure than reversible block ciphers? While AES as a block cipher [resisted attacks for more than 20 years][1], we have [ChaCha20][2] as a PRF candidate using CTR mode which has resisted attacks since 2008. It is faster than AES in software and has zero cost of key schedule! > it's possible two different inputs with the same key could result in the same output. Good luck with this collision: ChaCha20 has 512-bit output so you need $2^{256}$ random encryptions to see one with 50% probability (see birthday attack). > Would such a cipher make any sense at all? Are there such irreversible encryption-only block ciphers? Yes; ChaCha20 is the best candidate to show that this makes sense. And any PRF can be used in CTR mode for encryption; - [Is SHA-256 secure as a CTR block cipher?][3] > However, with CTR and irreversible encryption-only block cipher, you could to such a quick access. Well, yes and no. In this age, we don't advise using Ind-CPA security where the classical modes can only achieve this. To go beyond one needs authenticated encryption such as AES-GCM and ChaCha20-Poly1305. To have authentication one needs a tag, and before the tag verification one should not decrypt and use any part of the ciphertext. If there is a tag error, HALT! > (Title) Would an encryption-only block cipher be useful at all? As we see, it is no longer a block cipher. There are some benefits; - No padding oracles if CTR mode or similar is used. - There may be no need for a key schedule as in ChaCha. - No need for a separate decryption circuit; that makes it easy to securely implement and audit. - Using a PRP in CTR mode has a long message distinguisher that restricts the number of encryption blocks due to the PRP-PRF switching lemma. We don't have that with PRFs. [1]:/a/76746/18298 "Has AES-128 been fully broken?" [2]:https://cr.yp.to/chacha.html "Paper" [3]:/q/1656