I'm looking for an encoding scheme that requires a very large encoding key
E (>10MB) and suffices with a relatively small decoding key
D (<4kB). One should be able to prove some lower bound on
|E| using only knowledge about the scheme, the encoded message and
It would be great if the proposed scheme has computationally efficient primitives.
EDIT: A use case for this can be to encourage voluntary disposal of
E after encoding a smallish (~1MB) file.
EDIT 2: Ideally, it should not be possible to infer