# Slow encryption (or reverse time-lock)

Are there cryptographic scheme where encryption is sequential and take a long time (in a way that it can be quantified) while instead decryption with a secret key takes very short time?

Some sort of reverse time-lock encryption where it takes a long time to decrypt rather than encrypt?

(Either with symmetric or asymmetric)

• Generate a random key, encrypt the data, discard some number of bits from the key and publish it. You can't gate on the amount of time, but you can gate on "number of operations required, on average". Choose that number based on the number of ops/s you anticipate the other party will commit to decrypting the payload (taking Moore's law into account). Mar 16, 2017 at 23:19
• The question is not clear: It appears to be asking for an encryption technique that is slow, but then goes on to imply that decryption should be slow, rather then encryption? If "normal" "time-lock" encryption offers fast encryption and slow decryption, then does "reverse" time-lock encryption offer slow encryption with fast decryption? Mar 16, 2017 at 23:58
• yes @EllaRose. I have updated my question Mar 17, 2017 at 0:13
• I just have to ask: Why? Mar 17, 2017 at 11:02

One obvious way (which is a variant of the normal time-lock encryption technique) is to do RSA encryption, with a truly huge $e$.
That is, to encrypt, you compute $M^{3^\lambda} \bmod N$; by making $\lambda$ sufficiently large, you can make this take a long time.
To decrypt, you would have precomputed the values $(3^\lambda)^{-1} \bmod p-1$ and $(3^\lambda)^{-1} \bmod q-1$, which can be done in $O(\log \lambda)$ time; you proceed with RSA decryption in the standard way.