Is there such a thing as shortcutable key stretching? I'm curious if there's a cryptographic (or mathematical) technique for key stretching that


allows someone with a secret to quickly derive the final key, 
requires a deterministic number of rounds for stretching (ie is not probabilistic) for someone that does not have the secret.


Does such a thing exist? 

For context, I think this would be useful for a regular pseudo-atomic information exchange. Two parties would encrypt the information they want to exchange each with a key they derive using a seed and an additional secret, exchange the encrypted info, exchange the seeds, then exchange the additional secret. That way, one party can't simply wait until they've received the other key to send their key - even if they delay the last step, the counter-party can still derive the key (tho it will take more time). And if they delay the second-to-last step, the counter-party will know they're not cooperating.
Let $p$ and $q$ be secret uniform random primes, and define $n = pq$.  Consider $s = 2^{2^t} \bmod n$.


Without knowledge of $p$ or $q$, the best way we know to find $s$ is to start with $2$ and square it $t$ times successively.  We can tune $t$ to force the other party to take arbitrarily many steps.
With knowledge of $p$ and $q$, we can use the shortcut $2^e \equiv 2^{e \bmod \lambda(n)} \pmod n$ by Carmichael's theorem, since $\lambda(n) = \operatorname{lcm}(p - 1, q - 1)$; then it only takes one division of $t$ by $\lambda(n)$ and about $\log_2 n$ squarings and multiplications modulo $n$ to compute the answer, no matter what $t$ is.


But suppose you use this protocol.  What happens when one of the parties skips town just before the protocol is done?


  BOB: Hey, Alice, the combination to the box the magic words are in is $2^{2^{t_b}} \bmod n_b$ where $t_b = 1\,000\,000\,000\,000$ and $n_b = \dotsb$.
  
  ALICE: Great!  The secret to the meaning of life, the universe, and everything is encrypted with the key $2^{2^{t_a}} \bmod n_a$ where $t_a = 3\,141\,159\,265\,359$ and $n_a = \dotsb$.
  
  BOB: Awesome, thanks!  By the way, $n_b = p_b q_b$ where $p_b = \dotsb$ and $q_b = \dotsb$.
  
  ALICE: Ha-ha, sucker!  Have fun chasing meaning while I go open your box of magic words!
  
  BOB: Blast!  It will take my ASIC three hundred years to compute this.


Another approach you could try—which doesn't involve shortcuts—is to have each party reveal the secret bit by bit (or letter by letter) in lock-step:


  ALICE: The first letter of my secret is C.
  
  BOB: The first letter of my secret is V.
  
  ALICE: The second letter of my secret is H.
  
  BOB: The second letter of my secret is L.
  
  ALICE: The third letter of my secret is U.
  
  BOB: The third letter of my secret is F.
  
  ALICE: The fourth letter of my secret is M.
  
  BOB: The fourth letter of my secret is E.
  
  ALICE: The fifth letter of my secret is P, spelling out CHUMP, because you've given me enough to guess the rest of your secret by brute force and I ain't given you diddly squat!


The trouble is twofold:


Bob shouldn't have proceeded to divulge any of the secret without a verifiable proof that what Alice gave is actually part of her secret.
The protocol favors whichever party has more computational power—that party can abort the protocol at any time and leave the other one in the dust.