Recently we have seen a lot of papers on Post-quantum key-establishment (key encapsulation mechanism or Key-exchange), largely due to the standardization call of NIST for PQ-protocols. However, most of the work for example : Kyber, NTRU-prime, NTRU-KEM focuses on key-encapsulation rather than Key exchange. Now my questions are as follows :
KEM is a unilateral protocol whereas key-exchange is a bilateral protocol. i.e key is chosen by the client and server gets the key via decryption. Intuitively bilateral protocols (FRODO and NewHope) looks better than the unilateral (KEM) protocols. As both the parties participate in choosing the key. Then why there is more focus on KEM?
Consider this scenario, if we assume that Key exchange establishes a random key on both sides then Client can pick up a random string XOR with the key and send the XOR'ed value to the server. Since, server has the same key, server can easily retrieve the random string of client. Hence, a key exchange can work as PKE (as ElGamal from DH) and subsequently as a KEM. This scheme will be CPA secure as by assumption the established key is random. Hence, Key-exchange can is more flexible than KEM. Is it correct?
I understand that the current key-exchange schemes have a very high failure probabilities than KEMs. And, Hence they can be converted to CCA secure schemes by well known BLack-box transformations for key re-usability. But if we can come up with Key-exchange schemes with similar failure probabilities as KEMs and able to convert them to CCA secure schemes then should we favour Key-exchange schemes more than KEMs?
I appreciate your help.