Definition of Cascade for Blockciphers I have seen that given blockciphers $F,G : \mathcal{K} \times \mathcal{M} \to \mathcal{M}$, their cascade $F \circ G$ is defined to be $F \circ G : \mathcal{K}^2 \times \mathcal{M} \times \mathcal{M}$ via $(F \circ G)_{(K,K')}(M) = G_{K'}(F_K(M))$. My question is why it's done this way around, not the other order?

In "standard life" (see Wiki article), if I have two functions $f,g : X \to X$, then $(f \circ g)(x) = f(g(x))$. However above, writing $f = F_K$ and $g = G_{K'}$, we have, in essence, $(f \circ g)(m) = g(f(m))$.

I understand that it's just a formal convention, but it seems strange to pick the formal convention which is (or rather, appears to me to be) counter to the previously established convention.

Incidentally, I saw this notation in Hoang-Morris-Rogaway, twice on page 6.
It's at the authors discretion. See the footnote in the book (below). Also Wikipedia makes it clear.

: