  Quantum public-key encryption [Gottesman; Kawachi et al., Eurocrypt'05]
generalizes public-key encryption (PKE) by allowing the public keys to be
quantum states. Prior work indicated that quantum PKE can be constructed from
assumptions that are potentially weaker than those needed to realize its
classical counterpart. In this work, we show that quantum PKE can be
constructed from any quantum-secure one-way function. In contrast, classical
PKE is believed to require more structured assumptions. Our construction is
simple, uses only classical ciphertexts, and satisfies the strong notion of CCA
security.
