Soliloquy: a Cautionary Tale

The Soliloquy primitive, first proposed by the third author in 2007, is based on cyclic lattices. It has very good efficiency properties, both in terms of public key size and the speed of encryption and decryption. There are straightforward techniques for turning Soliloquy into a key exchange or other public-key protocols. Despite these properties, we abandoned research on Soliloquy after developing (2010 to 2013) a reasonably efficient quantum attack on the primitive. A similar quantum algorithm has been recently published in some highly insightful independent work by Eisenträger, Hallgren, Kitaev, and Song [2]. However, their paper concentrates on computing unit groups of arbitrary degree number fields whereas we will show how to apply the approach to the special case of Soliloquy.