Are there encryption schemes with which it takes (significantly) longer to encrypt than to decrypt?
Perhaps not of relevance if the question is meant in a purely thoretical (i.e. asymptotical) sense, but the CBC encryption mode is inherently sequential, while decryption can easily be performed in parallel.