I'm looking for an encoding scheme that requires a **very large encoding key `E`** (>10MB) and suffices with **a relatively small decoding key `D`** (<4kB). It would be great if the proposed solution has computationally efficient primitives. Although I don't think it's necessary for answering the question, I will nevertheless describe the intended application: > Alice sends Bob a file `F` (`|F| ~ 1MB`). At some later date Alice wants Bob to prove > he has access to both `F` and some encrypted counterpart `F'`, while > encouraging Bob to physically store `(F', D)` instead of `(F, E)`. Both these representations allow Bob to construct both (`F, F')`, but the latter should be designed to have significantly better space efficiency. > > Bob may choose `(E, D)` himself. Of course he must supply `D` to Alice shortly after having received `F`. If he does not, he would be able to just store `F`; generating `(E, D)` on the > fly when `F'` is requested.