Unclonable Functional Encryption

TL;DR

This paper introduces quantum functional encryption (QFE), extending classical FE to quantum messages and functions, and explores its connection to unclonable encryption, providing new constructions and theoretical insights.

Contribution

It presents the first construction of QFE based on quantum garbled circuits and links QFE to unclonable encryption, establishing foundational theoretical relationships.

Findings

QFE scheme allows polynomially-sized circuit evaluation on quantum messages.

Any QFE scheme achieves unclonable functional encryption (UFE) properties.

Unconditional link between quantum indistinguishability obfuscation and QFE.

Abstract

In a functional encryption (FE) scheme, a user that holds a ciphertext and a function key can learn the result of applying the function to the plaintext message. Security requires that the user does not learn anything beyond the function evaluation. We extend this notion to the quantum setting by providing definitions and a construction for a quantum functional encryption (QFE) scheme which allows for the evaluation of polynomialy-sized circuits on arbitrary quantum messages. Our construction is built upon quantum garbled circuits [BY22]. We also investigate the relationship of QFE to the seemingly unrelated notion of unclonable encryption (UE) and find that any QFE scheme universally achieves the property of unclonable functional encryption (UFE). In particular we assume the existence of an unclonable encryption scheme with quantum decryption keys which was recently constructed by [AKY24]. Our UFE guarantees that two parties cannot simultaneously recover the correct function outputs using two independently sampled function secret keys. As an application we give the first construction for public-key UE with variable decryption keys. Lastly, we establish a connection between quantum indistinguishability obfuscation (qiO) and quantum functional encryption (QFE); Showing that any multi-input indistinguishability-secure quantum functional encryption scheme unconditionally implies the existence of qiO.