I'm looking for an encoding scheme that requires a very large encoding key E
(>10MB) and suffices with a relatively small decoding key D
(<4kB). One should be able to prove some lower bound on |E|
using only knowledge about the scheme, the encoded message and D
.
It would be great if the proposed scheme has computationally efficient primitives.
EDIT: A use case for this can be to encourage voluntary disposal of E
after encoding a smallish (~1MB) file.
EDIT 2: Ideally, it should not be possible to infer E
from D
.