In my opinion, more reversible cryptographic functions should have already been thoroughly researched, so we are late with this. For example, when the NIST was selecting cryptographic functions for AES and SHA-2, they should have either incorporated reversible computing efficiency in their evaluation criteria, or they should have standardized reversible cryptographic functions separately. After all, Bitcoin was launched in 2009, but there was no RCO-POW to select, so Bitcoin could only use SHA-256 which has some reversible computational overhead, but we can do better.

 I already have launched an RCO-POW, but more research is needed (I may need to update the RCO-POW which is not something I like). I was able to develop the notion of an LSRDR and their generalizations (while everyone is hating me for this because humans are horrible and worthless and need to be deeply ashamed of themselves) in which we can in many cases just input the cryptographic function and then we can maximize fitness through gradient ascent (this is what AI does) to obtain numerical values for the cryptographic insecurity. I have applied compositional LSRDRs to the AES block cipher and have obtained numerical values for the AES's cryptographic security. This is easy to do for permutation substitution networks like the AES since one can apply CLSRDRs to sequences of S-boxes in the AES, but this works best when we have S-boxes; if we do not have S-boxes, then the LSRDRs will have to train a matrix for each possible input for the block cipher round function, and that means that the LSRDR may have billions of matrices. Unlike cryptographic functions like the SHA-256 and the AES, the block cipher round functions for RCO-POWs can get away with just a 32 bit message size (more or less) and as few as a single bit round key, and that makes LSRDRs efficient for analyzing RCO-POWs since the block ciphers for RCO-POWs are miniaturized.

As a bonus, LSRDRs and CLSRDRs have some interesting behavior. If we train an LSRDR or CLSRDR multiple times, we often converge to the same trained model (up to floating point errors and symmetry), and we often get the exact same fitness level (up to floating point errors) with LSRDRs and CLSRDRs. This does not happen all the time (it does not happen with AES that often), but it could happen with RCO-POWs and especially with block ciphers with lesser security requirements and smaller key sizes. If we obtain the exact same fitness level when training LSRDRs multiple times, this means that LSRDRs give us really precise information about the cryptographic security of those block ciphers.

I am good at working with LSRDRs to evaluate the cryptographic security of cryptographic functions, and others may be able to use other techniques to further evaluate the cryptographic security, but we also need to have precise measures of the efficiency. In particular, we want the ratio of the efficiency of RCO-POWs on reversible to irreversible hardware to be maximized, but I am not a hardware person; I just do the cryptography.

Regards,

-Joseph Van Name Ph.D.