Encrypt to someone's public key: do a one-off key exchange with them, then use fast ordinary encryption.
The idea: Public-key encryption without a special encryption algorithm: the sender makes a throwaway key pair, does a Diffie-Hellman exchange with the recipient's public key on the spot, and uses the shared secret as the key for fast symmetric encryption. The throwaway public key travels with the message, so the recipient can do the same exchange from their side and get the same key.
Why it matters: Used by modern privacy features such as Encrypted Client Hello.
Public-key encryption assembled from Diffie-Hellman plus a key derivation function and symmetric authenticated encryption: make a fresh key pair, do Diffie-Hellman with the recipient's public key, derive a key, encrypt.
HPKE (RFC 9180)[1] standardizes this and is used in Encrypted Client Hello[2], MLS group messaging[3] and Oblivious HTTP[4]. Proofs model the key derivation as a random oracle (ROM).
If any of these breaks, this breaks too.
If this breaks, these break with it.
Nothing on the map depends on it: it is an end point, something people use directly.