  Encryption of data is fundamental to secure communication in the modern
world. Beyond encryption of data lies obfuscation, i.e., encryption of
functionality. It is well-known that the most powerful means of obfuscating
classical programs, so-called ``black-box obfuscation',' is provably impossible
[Barak et al '12]. However, several recent results have yielded candidate
schemes that satisfy a definition weaker than black-box, and yet still have
numerous applications.
  In this work, we initialize the rigorous study of obfuscating programs via
quantum-mechanical means. We define notions of quantum obfuscation which
encompass several natural variants. The input to the obfuscator can describe
classical or quantum functionality, and the output can be a circuit description
or a quantum state. The obfuscator can also satisfy one of a number of
obfuscation conditions: black-box, information-theoretic black-box,
indistinguishability, and best possible; the last two conditions come in three
variants: perfect, statistical, and computational. We discuss many
applications, including CPA-secure quantum encryption, quantum
fully-homomorphic encryption, and public-key quantum money.
  We then prove several impossibility results, extending a number of
foundational papers on classical obfuscation to the quantum setting. We prove
that quantum black-box obfuscation is impossible in a setting where adversaries
can possess more than one output of the obfuscator. In particular, generic
transformation of quantum circuits into black-box-obfuscated quantum circuits
is impossible. We also show that statistical indistinguishability obfuscation
is impossible, up to an unlikely complexity-theoretic collapse. Our proofs
involve a new tool: chosen-ciphertext-secure encryption of quantum data, which
was recently shown to be possible assuming quantum-secure one-way functions
exist [Alagic et al '16].
