@promovicz i have a really terrible symmetric algorithm based upon the final point, and as you may have [intuituted it works by squaring or something, in fact, without workiing too hard by spliting it halfway, and following the point of some .
there's a curious connection.! in the forward [heroic] direction, modular expentiation, we wanted to force our adversity to perform some maximum form of work which coulld not be replaced or amortized. of course you know of the CSPRNG use case for discrete log -- i am now working to understand and determine the subcyclic behavior so that we achieve both computational and informational unguessability.
now consider an insecure system: you could break e.g. the key scheduler for the AES-encoded message. but (speakiung abstractly here) you cannot invert the transformation uniquely at all without the key for my half-assed cipher, because it mixes and modifies data across the entire length of the message, and the message is also a cyclic group if you go both directions, outwards from the center! and i fully believe this is in fact capable of (if certainly not now) the precise unconditional security that claude shannon was so stumped on.
you could also establish the cross-influence upon the key and the message and determine more specific bounds, according to a model of computation and (if you're careful) an "oracle" or "game" experiment with bounded security failures.
dataflow serves as a kind of "conservation of energy"-like principle for me to design safe systems. one reason i despise the "probabilistic turing machine" is because it directly makes excuses and cheats auditors of the author's clever notation. but for discrete log, there is a fundamentally serial computation required to factor the largest subgroup of q - 1. and that is in fact how you can achieve security. and the turing machine happens to represent that alright in many cases
