# Is there a public-key cryptography method that enables public keys to be much smaller than private keys?

Does a public key cryptography method that enables the public key to be orders of magnitude smaller than the private key exist?

• Yes. $\:$ It's called "pad the private key". $\;\;\;\;$ – user991 May 25 '14 at 6:58
• Stretching a secret key often appears in the context of leakage-resilient cryptography. – xagawa May 27 '14 at 2:48

In practice the leaves are not usually all stored, but derived from a shorter key. Even then it may be useful to store e.g. $O(h)$ hashes to accelerate signing, where $h$ is the tree height. With CMSS (pdf) $T$ levels of trees are generated and the signer stores the verification keys for the active tree at each level, which is about $T$ times as much data as the public key.
Yes, there are public-key cryptographic systems with a public key orders of magnitude smaller than the private key. One way to illustrate this is modifying a cryptosystem to make its private key larger: as noted by Ricky Demer we can use padding; another example would be an RSA variant where the private exponent $d$ is replaced by $d'=((p-1)\cdot(q-1))^{(10^3)}+d$, making the private key $3$ orders of magnitude larger than the public key.
• Note that second-preimage resistance is not necessarily sufficient for this answer's last paragraph, since the original signature verification key is not necessarily uniformly distributed, and even when it is uniformly distributed, the adversary can see signatures for it. $\:$ In general, an eTCR property would suffice, although the signatures would also need to include the hash's randomness. $\;\;\;\;$ – user991 May 26 '14 at 5:39