Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?

Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?

I am thinking of a specific situation in which a server continuously receives encrypted messages from different senders and has to decrypt each single one of them. To cope with the possibly large amount of messages the decryption process should be fast. However, to avoid that the senders send a large amount of automatized messages, the encryption process should take much longer.

Ideally, the time to encrypt a single message should still be acceptable, but it should become unfeasible to send a large amount of messages in a short time. The specific type of encryption does not matter and the server can be assumed to have all the necessary keys for the decryption of the messages (without the key, of course, the decryption process should take much much longer!).

In other words, sending a message should be "expensive", while receiving the message should be "cheap". Is there an encryption scheme that shifts the computational load to the side of the sender, so that it takes longer to encrypt than to decrypt a message?

• – user991 Jul 13 '16 at 16:55
• I made a tunable slow encryption function recently. It's certainly not standardized (and therefore to be considered “unsafe until further notice’), but the idea might set you in the right direction. Disclaimer: This is from my personal github. – Ella Rose Jul 13 '16 at 17:08
• What about applying a PoW (with fast verification) on the cipher text so the server can verify before attempting decryption – SEJPM Jul 13 '16 at 18:28
• This seems more easily solved at a different layer. You can throttle connections per-host with, e.g., iptables. This also has the advantage that it can't be trivially bypassed by an attacker (who can just flood you with random garbage instead of valid messages). – Stephen Touset Jul 13 '16 at 18:28
• @StephenTouset Yes. My comment was not supposed to be a recommendation on what to implement; it should merely show that "encryption takes longer than decryption" does not necessarily imply "overwhelming the server is expensive". – yyyyyyy Jul 13 '16 at 19:19