Post-quantum cryptography concentrates on cryptographic algorithms that remain secure in the face of large scale quantum computers. In general, the main focus seems to be on public-key encryption algorithms and public-key signature algorithms - but there are dozens of other constructs like hashes, block ciphers, etc. - but with a quick peek, I didn't find any key agreement algorithms.
Most of todays interactive communication is focused on key agreement via Diffie-Hellman and authentication on top of that - the goal is to set up a "secure channel". Some schemes use signatures for non-repudiable authentication, but many use Diffie-Hellman for repudiable authentication. There are many protocols for key agreement, with varying security properties, that mostly just use Diffie-Hellman in complex ways and depend on the DDH or CDH assumptions on security. As an example of the protocols I mean, I present YAK and J-PAKE.
Now, my question is, what is the post-quantum cryptography answer to establishing a secure channel? Or, specifically - anonymous key agreement, authenticated key agreement and password-authenticated key agreement?
All of the different post-quantum cryptography systems seem to have some big drawback - large signatures, large public keys, large processing requirements etc. - so I am wondering which would offer the best tradeoff for key agreement?
In general, it would seem that any public key encryption algorithm could be used pretty easily for key agreement - but are there any concrete proposals on cryptographic protocols doing key agreement for some post-quantum cryptography algorithm? What properties do these provide, such as PFS, UKS, KCI, deniability, etc? Simply encrypting a random key to the recipients public key does not achieve forward secrecy, unless the recipient public key is ephemeral (random generated each time). If it is ephemeral, the question becomes how to tie some authentication in to the ephemeral key agreement, for which there's no obvious best method but a number of tradeoffs.
I understand that post-quantum cryptography isn't ready yet for general use - and the primitives are not secure enough or standardized enough to use these kinds of protocols in the real world yet - but it feels like there should be more preliminary work done on this problem as well. If you disagree, please let me know that, too!