Encryption in which ciphertext is bigger than plaintext? Is there an encryption which would produce a ciphertext longer than the plaintext?
(please ignore block-chaining IV stuff, which would result in a data being generated from the plaintext).

The point in question is that a ciphertext generated $\{0,1\}^n$ seems inferior to one twice as long $\{0,1\}^{2n}$ in terms that more permutations are possible in the later one.    

Yet if the plaintext was of a blocktype being $\{0,1\}^n$ it seems puzzling how the encryption would map bothways
$$\{0,1\}^n \to \text{encrypt} \to \{0,1\}^{2n}$$ and
$$\{0,1\}^{2n} \to \text{decrypt} \to \{0,1\}^n$$

I assume this question to touch on the necessary attriubutes of encryption that it is reversibility and deterministic behaviour both way.
There's no blockcipher providing this.

However if you want this kind of mapping there are two usage scenarios.


Strengthen the symmetric encryption. You could double the keysize by this construction. In "Applied Cryptography" Schneier suggested to combine two encryption algorithms so the ciphertext would be double the size of the plaintext.

Generate a pad $R$ at random, as long as your message
Calculate $P=R \oplus M$
Encrypt $P$ using one Cipher-Key-Pair
Encrypt $R$ using the other Cipher-Key-Pair

It might be possible to construct an online AEAD mode with intermediate tagging as one could basically authenticate each single block of the message. F.ex. using HMAC + CTR on 512-bit blocks one could encrypt the continous data stream using CTR and place the 512-bit HMAC tag after each 512-bit block. This might be nice, as you've got all the desireable properties of online encryption and intermediate tag verification that such modes provide. It might as well be possible to construct such a mode using a blockcipher (and maybe something like VMAC).


However for the first usage scenario there's no need as current blockciphers are secure enough and if you need larger blocksizes simply switch to something like Threefish.