We construct quantum public-key encryption from one-way functions. In our construction, public keys are quantum, but ciphertexts are classical. Quantum public-key encryption from one-way functions (or weaker primitives such as pseudorandom function-like states) are also proposed in some recent works [Morimae-Yamakawa, eprint:2022/1336; Coladangelo, eprint:2023/282; Barooti-Grilo-Malavolta-Sattath-Vu-Walter, eprint:2023/877]. However, they have a huge drawback: they are secure only when quantum public keys can be transmitted to the sender (who runs the encryption algorithm) without being tampered with by the adversary, which seems to require unsatisfactory physical setup assumptions such as secure quantum channels. Our construction is free from such a drawback: it guarantees the secrecy of the encrypted messages even if we assume only unauthenticated quantum channels. Thus, the encryption is done with adversarially tampered quantum public keys. Our construction is the first quantum public-key encryption that achieves the goal of classical public-key encryption, namely, to establish secure communication over insecure channels, based only on one-way functions. Moreover, we show a generic compiler to upgrade security against chosen plaintext attacks (CPA security) into security against chosen ciphertext attacks (CCA security) only using one-way functions. As a result, we obtain CCA secure quantum public-key encryption based only on one-way functions.

翻译：我们基于单向函数构造了量子公钥加密方案。在我们的构造中，公钥是量子的，但密文是经典的。近期的一些工作也提出了基于单向函数（或更弱的原语，如伪随机函数态）的量子公钥加密方案 [Morimae-Yamakawa, eprint:2022/1336; Coladangelo, eprint:2023/282; Barooti-Grilo-Malavolta-Sattath-Vu-Walter, eprint:2023/877]。然而，这些方案存在一个重大缺陷：仅当量子公钥能够在传输给发送方（运行加密算法的一方）时不被对手篡改的情况下，它们才是安全的，这似乎需要诸如安全量子信道等不令人满意的物理设置假设。我们的构造避免了这一缺陷：即使我们仅假设存在未经认证的量子信道，它也能保证加密消息的机密性。因此，加密过程是在对手可能篡改量子公钥的情况下进行的。我们的构造是首个实现经典公钥加密目标的量子公钥加密方案，即仅基于单向函数在不安全信道上建立安全通信。此外，我们展示了一种通用编译器，仅使用单向函数即可将选择明文攻击安全性（CPA 安全性）提升为选择密文攻击安全性（CCA 安全性）。最终，我们获得了仅基于单向函数的 CCA 安全量子公钥加密方案。