I've been made aware of this question as a possible dup of one i have asked. I'm surprised that there is not much already established in this area. So here's my idea so far, but i think it needs more work;
instead of finding by brute force progressive segments of the plaintext as suggested by @Ella Rose, my idea instead was to do the same but to the key;
Make a, say, 2048 bit key at random and encrypt the plaintext. Split the key into
n parts of
m bits each (ie m*n = 2048), then emit
n hashes, each of separately the
m bit segments, using your favourite hash algorithm. Throw original key away.
To decode, brute force guess each of the
n segments until its hash agrees with the given. Finally decode the ciphertext using the recovered key.
m bigger and
n smaller increases decode time. Keep
n a reasonable size to allow "guess" averaging of time.
I didn't previously think of overlapping the hashes as suggested by @Ella Rose's answer. this is a good idea as well to resist a parallel attack.