This question was asked and answered on security.stackexchange: Would it be secure to generate random number using AES?

You probably need to elaborate a bit on what you mean with "still be able to display a result". For typical ciphers, you would get bogus output if you use the wrong key. Are you looking for a scheme that allows you to decrypt one ciphertext to two (or more) meaningful plaintexts depending on which key you use?

@HenrickHellström can you elaborate on scenario? Perhaps I'm misinterpreting it, but I do not see any context in which it could be relevant to bind the person constructing a CSR to a specific keypair

Right. There's another class of functions, though; those that are not vulnerable to timing attacks, but still take a varying amount of time (e.g. due to some rejection sampling from a PRG). My comment stems from the fact that there does not seem to be a clear word to describe such functions.

When you say "isochronous -- i.e., with data-independent runtime", do you mean variable/random time but not based on secret data, or do you mean constant time (i.e. exactly the same number of time units)?

I agree that I (perhaps falsely) jumped to the conclusion that Ned was talking about a monoalphabetic substitution, but I still think that picking out Vigenere and attacking that instead is a gross over-specification. At the very least, it needs an "if your cipher is actually Vigenere" note.

You seem to target Vigenère ciphers, but Ned was asking for attacks on substitution. These do not immediately translate, as well; this is why they're listed precisely like you listed them, on the Vigenère wikipedia page.