From the LoRaWAN specifications:
Note: The network server uses an AES decrypt operation in ECB mode to encrypt the join-accept message so that the end-device can use an AES encrypt operation to decrypt the message. This way an end-device only has to implement AES encrypt but not AES decrypt.
That sounds nice, but I think it only applies to Join-Accept messages, allowing for cheap Class A nodes, if they don't expect any response in the downlink receive window?