Q:

How to create a time lock encryption

I want to encrypt a file such that the decryption will take at least X days on a standard computer. I figure that the best way to do this is to save only a partial key, such that the missing part of the key will take X days to determine by the most efficient technique (brute force or better).
Is there precedent for this type of encryption? Are there any off-the-shelf tools that do it?

A:

The traditional answer is computing 2^(2^x) mod n for a semi-prime n. This has some nice properties:

It's efficient to computer for the challenger, because there is a shortcut when you know the factors of n.
The construction cannot be parallelized. So the attacker needs to compute squarings sequentially, preventing them from speeding up the attack by throwing more resources at it.
But the attacker can still exploit the parallelism within a squaring using custom hardware, giving a considerable speedup compared to standard CPUs.
The number of iterations needed is deterministic. You can't get lucky or unlucky.

LCS35 Time Capsule Crypto-Puzzle by Ronald L. Rivest has the details, including Java code to generate a challenge.

Letting the attacker brute-force a (short) key is not a good time puzzle. It's trivial to parallelize, if you throw twice as much hardware at the problem, you solve it twice as fast. In addition to that, the runtime is random and you can only choose the expectancy value for the required effort (this could be fixed by having a number of separate challenges).

