# Why in BCNS protocol both parties don't follow the exact same key extraction approach

Why in BCNC key-exchange protocol (page 8), Bob instead of:

$K_B \leftarrow \lfloor \bar v \rceil_{2q,2} \in \{ 0, 1\}^n$

$K_B \leftarrow rec(2bs', c) \in \{0, 1\}^n$.

or they are the same thing ... am I missing something? I don't understand the purpose of modular rounding function as defined by Peikert in Lattice Cryptography for the Internet (page 9) and BCNS (page 6)

Because the idea is one party (i.e. Bob) sends a signal or reconciliation information (i.e. $c$) to other party (i.e. Alice) and then both should follow the exact same approach to get one bit from every coefficient.

• This is Avery interesting question. But I need some ground work to answer – user38956 Mar 17 '17 at 2:29
• @Node.JS in Ring-LWE key-exchange the resulting polynomial of both parties are not exactly equal but the coefficients are very close. So the reconciliation method tries to extract a bit from every coefficient. What I don't understand is that both parties should follow the same reconciliation approach, maybe they are already doing the same thing approach but I did not understand. This is the wiki page for R-LWE key-exchange: en.wikipedia.org/wiki/Ring_learning_with_errors_key_exchange – Node.JS Mar 17 '17 at 2:34

Answer of your question is in page $7$.
For odd $q$, let $v=w+e\in Z_q$ for $w,e\in Z_q$ such that $2e\pm 1\in E \pmod q$. Let $\bar v=dbl(v)$ then $rec(2w,\langle \bar v\rangle _{2q,2})=\lfloor \bar v \rceil _{2q,2}$.