# Two-way encryption algorithms similar to bcrypt

I'm in need of an algorithm that can perform a very specific task: take a short string, encrypt it using an algorithm which can be scaled to keep up with Moore's Law/has a proof-of-work factor/is unusually slow, and then, later, decrypt it at the same time cost.

The use case is a list of email addresses being stored for a mailing list by a security-conscious client, to be decrypted one at a time for each email; the goal is to make brute-forcing as time-consuming as possible. I've looked into some of the likely candidates (AES-256, mcrypt, twofish, scrypt), but it's unclear which would be best suited.

• Go for AES-256-GCM or xChaCha20-Poly1305. Oct 17 '21 at 16:02
• "decrypt it at the same time cost"; do you mean "the same time cost as encryption"? Or, do you mean "at a time cost which is the same independent of the encryption cost factor"? Oct 17 '21 at 16:02
• @kelalaka: how does AES-GCM or ChaCha have a "proof of work" factor? Oct 17 '21 at 16:03
• @poncho I don't think that the OP really wants slow encryption, rather the goal is to make brute-forcing as time-consuming as possible. 256-bit encryption is enough with a good password and a PBKDF. AES-GCM or ChaCha doesn't have proof of work factor and they don't need, too. Oct 17 '21 at 16:10
• Note that, scrypt is a password-based key derivation function created by Colin Percival,. Do you actually want a slow PBKDF and a fast encryption that is secure enough bruteforce? Oct 17 '21 at 16:48

My recommendation is to use Output Feedback (OFB) mode. Generate a unique Initial Value; feed this into the (e.g.) AES block cipher; then feed the output back into the cipher and repeat, say, $$2^{35}$$ times depending on exactly how much time you want to require of the client. Then XOR future outputs onto the e-mail address. The encryption/decryption time will decrease with Moore's law, but there is no benefit in buying more hardware.