Calculation-Intensive Decryption I'm looking for an encryption scheme that has the following properties:


Decryption is CPU intensive, so decrypting an encrypted text may take some time (relatively, of course). Preferably, encryption should be negligible.
The time to decrypt can be easily raised.
The time to decrypt can be easily lowered.


Naively, I could accomplish #2 and #3 by re-encrypting the data n times and increasing and decreasing n to raise or lower the decryption time.

Is there any such encryption method?
You could throw away bits of the encryption key so that there is a brute-force portion to decrypting e.g. encrypt with a 128-bit key but only share 96 bits.

Or protect the key using something like an RSA time-lock puzzle. The benefit of this is recovering the key cannot be sped up with parallelism.