Hardware AES: can we have a decryption implementation only? I'm wondering if implementing only the AES decryption can reduce the hardware cost? And does anybody have some examples of the cost (speed, size) of hardware AES implementation?
In practice, AES encryption mostly use CTR mode or some authenticated encryption, and in these the block cipher itself is only used for encryption. There is thus often no need to implement AES decryption in hardware.

We can always remove features from hardware circuitry. Implementing only the AES encryption sizably reduce the hardware cost (compared to also implementing decryption), but implementing only decryption saves much less (especially for cost-optimized rather than speed-optimized designs), because:


Decryption requires (as does encryption) forward-computing the round keys, and (specific to decryption) either storing them or walking backward. Therefore the relatively large saving possible for round keys computation by omitting said storage or capability to walk backward has no equivalent when omitting encryption.
The S-box used for encryption and the (inverse) one used for decryption are different, and there's sizable saving possible by omitting the decryption one. However the two are not needed simultaneously; it is feasible to share some gates between the two; and even in speed-optimized implementations where that's not done, it might still be possible to reduce to almost nothing the power consumption (and associated costs) of the inactive S-Box.
The MixColumns step for decryption is significantly more complex than the one for encryption, and it is feasible to share a lot of gates between the two, so that omitting encryption capability won't necessarily save much there.