Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?
I am thinking of a specific situation in which a server continuously receives encrypted messages from different senders and has to decrypt each single one of them. To cope with the possibly large amount of messages the decryption process should be fast. However, to avoid that the senders send a large amount of automatized messages, the encryption process should take much longer.
Ideally, the time to encrypt a single message should still be acceptable, but it should become unfeasible to send a large amount of messages in a short time. The specific type of encryption does not matter and the server can be assumed to have all the necessary keys for the decryption of the messages (without the key, of course, the decryption process should take much much longer!).
In other words, sending a message should be "expensive", while receiving the message should be "cheap". Is there an encryption scheme that shifts the computational load to the side of the sender, so that it takes longer to encrypt than to decrypt a message?