The conversion of Diffie-Hellmen into Elgamal is assisted by a few factors that are not inherent to key exchange/agreement protocols in general, but a general conversion may be possible.
The DH $\rightarrow$ Elgamal case. In Diffie-Hellman, Alice generates $a$ and sends a representation of it: $g^a$. Bob generates $b$ and sends $g^b$. Both parties can compute $g^{ab}$. To convert to Elgamal, Alice starts the protocol generating $a$ and posts $g^a$ so anyone can complete Diffie-Hellman with her. If Bob wants to complete the protocol, he generates $b$ and sends $g^b$. To make it encryption, he generates the shared secret $g^{ab}$ and multiplies in his message $mg^{ab}$ and sends that as well.
Why is this CPA-secure? Under DDH-assumption $g^{ab}$ is indistinguishable from a random group element so it works as a sort of one-time pad. Since the sender contributes $b$ to the random mask, each encryption of the same message results in a different ciphertext.
What is needed for a general conversion? (These is just "brainstorming" and not meant to be comprehensive).
- It is important to have a DDH-type assumption that shows the shared secret is indistinguishable from random.
- The shared secret must be an element of a group so there is a permissible operation that can be used to combine it with the message with closure.
- The conversion is also assisted by being from an unauthenticated key exchange. Most other common key exchange protocols are authenticated (or mutually authenticated). This doesn't necessary prevent a conversion, just adds unnecessary weight to the encryption scheme (and if you strip off the authentication, you may find yourself back at basic Diffie-Hellman).
- As per @Paulo's comment, Alice's first move must be securely repeatable.
- While in DH, this does not occur, there is not problem with Bob using Alice's output from the first move to generate his share. So two-round protocols are fine when only one party is needed in the second round.
It would be interesting if you could provide some examples of other key exchange protocols that are eligible for conversion. I think you'll find the majority are either based on adding properties to Diffie-Helman that assists in making it a better key exchange but doesn't assist you in a conversion, or they don't lend themselves to conversion (too many rounds, they already use public key encryption, etc.)
