Can AES decryption be used as encryption? Definition 


E: AES encryption
D: AES decryption
x: plain text 
y: encrypted text
k: key


In original AES cipher,


encryption: y = E(x, k)
decryption: x = D(y, k)


Then I define the "reverse AES cipher" as below.


encryption: y = D(x, k)
decryption: x = E(y, k) 


Is "reverse AES cipher" safe as original AES?
or, is safe but the strength is not simply comparable with AES?
or, is not safe?

Or, do anyone know any ciphers that can be used as above and are safe and practical as AES?
First, I'll assume we're talking about encrypting/decrypting exactly 128 bits of data, i.e. the block size of AES. Otherwise, you'll need to specify a mode of operation &mdash; and if your data's length isn't a multiple of the block size, well, that'll be more difficult to deal with. So, I'll assume we're working with a single block. (If you are using a mode of operation, the below doesn't apply; see the other answer(s) for more details.)

AES models a theoretical construction called a pseudorandom permutation (PRP). Essentially, this means that if we set up a game where we give a polynomial-time-limited adversary access to either (1) an oracle computing a truly-random permutation or (2) an oracle computing the pseudorandom permutation (with a randomly chosen key), the adversary cannot determine which they were given access to with any non-negligible advantage. (They can always guess one or the other, so they have a 50% chance of guessing right; what the PRP security requirement states is that they can't get any non-negligible chance over that 50%.) 

There is a stronger notion of a PRP called a strong pseudorandom permutation. In the strong PRP game, the adversary is given access not just to an oracle computing the permutation in question: they're also given access to the inverse of the permutation. In terms of block ciphers, this means that instead of getting access to just an encryption oracle, they would also get access to a decryption oracle.

As far as we know, AES is indeed a strong PRP, so for single blocks, swapping the encryption and decryption functions should be fine. You could then use this in other block cipher modes of operation, for instance.