Key exchange devices and method

A first electronic network node (110) configured for a key exchange protocol, KEX, the first network node comprising - a communication interface (120) arranged for digital communication with a second network node, - a processor circuit configured to - obtain a shared matrix A, the shared matrix A being shared with the second network node through the communication interface, the entries in the shared matrix A being selected modulo a first modulus q, - generating a private key matrix SI, the entries in the private key matrix SI being limited in absolute value by a limit s, - generating a public key matrix PI - calculating an array product between shared array A and private key array SI, obtaining modulo the first modulus q a matrix product - scaling the inputs in the matrix product downward to a second modulus p, being a scaled input equal to the unscaled input multiplied by the second modulus p, divided by the first modulus q and rounded to the nearest integer, the second module p being smaller than the first module q, the limit s being at most the second module p, - send the public key matrix PI from the first network node to the second network node, - receive a public key matrix PR from the second network node, - calculate a raw key as an matrix product between the received public key PR of the second node and the private key matrix SI of the first network node modulo the second module p, wherein the first network node is further configured to - receive reconciliation data h from the second network node, - calculate a shared key by applying a reconciliation function rec to the reconciliation data received h and the raw key, or where the first network node is additionally configured to - obtain the shared key and reconciliation data h from the key without process, - send the reconciliation data h to the second network node.