A second cryptographic device comprising - a communication interface configured to communicate with a first cryptographic device, - a processor configured to - receive a first public key (b) for the first cryptographic device from the first cryptographic device, the first public key (b) being generated from an ephemerally generated first private key, - generate a second private key (s), a code word according to an error correcting code at least in part randomly, and generate a second public key (u) from the second private key (s), wherein the code word is generated independent from the first public key, the second private key, and the second public key, - generate a second raw shared key (k ∗) from the first public key (b) and the second private key (s), wherein - the first and second public key, the second private key and the second raw shared key are a matrix over a finite field or ring, the second public key being obtained from the second private key by a noisy multiplication with a shared matrix (a), - encapsulate the code word using the second raw shared key by applying an encapsulation function, obtaining encapsulated data (c), - derive a shared cryptographic key from at least the data encoded in the code word, - transfer the second public key (u) and the encapsulated data (c) to the first device. - a communication interface configured to communicate with a first cryptographic device, - a processor configured to - receive a first public key (b) for the first cryptographic device from the first cryptographic device, the first public key (b) being generated from an ephemerally generated first private key, - generate a second private key (s), a code word according to an error correcting code at least in part randomly, and generate a second public key (u) from the second private key (s), wherein the code word is generated independent from the first public key, the second private key, and the second public key, - generate a second raw shared key (k ∗) from the first public key (b) and the second private key (s), wherein - the first and second public key, the second private key and the second raw shared key are a matrix over a finite field or ring, the second public key being obtained from the second private key by a noisy multiplication with a shared matrix (a), - encapsulate the code word using the second raw shared key by applying an encapsulation function, obtaining encapsulated data (c), - derive a shared cryptographic key from at least the data encoded in the code word, - transfer the second public key (u) and the encapsulated data (c) to the first device. - receive a first public key (b) for the first cryptographic device from the first cryptographic device, the first public key (b) being generated from an ephemerally generated first private key, - generate a second private key (s), a code word according to an error correcting code at least in part randomly, and generate a second public key (u) from the second private key (s), wherein the code word is generated independent from the first public key, the second private key, and the second public key, - generate a second raw shared key (k ∗) from the first public key (b) and the second private key (s), wherein - the first and second public key, the second private key and the second raw shared key are a matrix over a finite field or ring, the second public key being obtained from the second private key by a noisy multiplication with a shared matrix (a), - the first and second public key, the second private key and the second raw shared key are a matrix over a finite field or ring, the second public key being obtained from the second private key by a noisy multiplication with a shared matrix (a), - encapsulate the code word using the second raw shared key by applying an encapsulation function, obtaining encapsulated data (c), - derive a shared cryptographic key from at least the data encoded in the code word, - transfer the second public key (u) and the encapsulated data (c) to the first device.