MoRo: From One-Sample Ring-LWE Rounding Key Exchange to Module-LWE IND-CCA KEM

With the growing need for long-term secure communications in Internet-of-Things (IoT) and sensor-network environments, practical and robust post-quantum key-establishment mechanisms have become increasingly important. In this work, we revisit the ephemeral-only Ding key exchange (DKE) proposed at ACNS 2019, which is based on one-sample Ring Learning With Errors (Ring-LWE) with rounding, and the original analysis of which covers only passive security. Building on the DKE framework, we propose MoRo-KEM, a Module Learning With Errors (Module-LWE)-based key-encapsulation mechanism using rounding. First, we lift the construction from the Ring-LWE setting to the Module-LWE setting, retaining ring-level efficiency while enabling more flexible parameter choices and reducing reliance on rigid algebraic structure. Second, we replace discrete Gaussian sampling for secrets and errors with centered binomial sampling, thereby simplifying constant-time vectorized implementations while preserving the required noise behavior. Third, we extend the resulting key-exchange core to an IND-CPA-secure public-key encryption scheme and further obtain an IND-CCA-secure KEM via the Fujisaki–Okamoto transform. Finally, at security level I, MoRo-KEM achieves a decryption failure rate of 2−166, lower than the 2−139 reported for CRYSTALS-Kyber, thus improving robustness against decryption-failure attacks. These properties make the proposed design attractive for secure key establishment among sensor nodes, edge devices, and gateways operating under constrained computation, memory, and communication budgets. Overall, our construction provides a concrete path from ephemeral key exchange to a practical IND-CCA-secure KEM instantiated over Module-LWE.