We construct quantum public-key encryption from one-way functions.In our construction, public keys are quantum, but ciphertexts are classical. Quantum public-key encryption from one-way functions (or weaker primitives such as pseudorandom function-like states) are also proposed in some recent works [Morimae-Yamakawa, eprint:2022/1336; Coladangelo, eprint:2023/282; Barooti-Grilo-Malavolta-Sattath-Vu-Walter, eprint:2023/877]. However, they have a huge drawback: they are secure only when quantum public keys can be transmitted to the sender (who runs the encryption algorithm) without being tampered with by the adversary, which seems to require unsatisfactory physical setup assumptions such as secure quantum channels. Our construction is free from such a drawback: it guarantees the secrecy of the encrypted messages even if we assume only unauthenticated quantum channels. Thus, the encryption is done with adversarially tampered quantum public keys. Our construction is the first quantum public-key encryption that achieves the goal of classical public-key encryption, namely, to establish secure communication over insecure channels, based only on one-way functions. Moreover, we show a generic compiler to upgrade security against chosen plaintext attacks (CPA security) into security against chosen ciphertext attacks (CCA security) only using one-way functions. As a result, we obtain CCA secure quantum public-key encryption based only on one-way functions.

翻译：我们基于单向函数构造了量子公钥加密方案。在该构造中，公钥为量子态，但密文为经典信息。近期的一些工作[Morimae-Yamakawa, eprint:2022/1336; Coladangelo, eprint:2023/282; Barooti-Grilo-Malavolta-Sattath-Vu-Walter, eprint:2023/877]也提出了基于单向函数（或更弱的原语，如伪随机函数类状态）的量子公钥加密。然而，这些方案存在一个严重缺陷：它们仅在量子公钥能够在不被对手篡改的情况下传输给加密算法执行者（发送方）时才安全，而这需要诸如安全量子信道等不切实际的物理假设。我们的构造消除了这一缺陷：即使仅假设非认证量子信道，仍能保证加密消息的机密性。因此，即使用于加密的量子公钥已被对手篡改，加密过程依然安全。我们的构造首次基于单向函数实现了经典公钥加密的目标——即在不安全信道上建立安全通信。此外，我们展示了一种通用编译器，仅使用单向函数即可将针对选择明文攻击的安全性（CPA安全性）提升为针对选择密文攻击的安全性（CCA安全性）。由此，我们基于单向函数获得了CCA安全的量子公钥加密方案。