A key agreement system, comprising a first device (600, 800) and a second device (700, 800), wherein the first device (600, 800) is configured to: generate a private-public key pair by using a key generation algorithm, and send a public key in the private-public key pair to the second device (700, 800); the second device (700, 800) is configured to: select an original key (k = K∥K') based on the received public key (pk) by using an encapsulation algorithm, obtain a ciphertext based on the public key and the original key by using the encapsulation algorithm, obtain a commitment value and an opening value (t) based on a first bit string and a random number (r) by using a commitment algorithm, and send the ciphertext and the commitment value to the first device (600, 800), wherein the first bit string is a random bit string; and determine a second bit string based on some bits in the original key, and calculate a first result as an exclusive OR of the first bit string and the second bit string; the first device (600, 800) is further configured to: obtain the original key based on a private key in the private-public key pair and the received ciphertext by using a decapsulation algorithm, determine the second bit string based on the some bits in the original key, calculate a second result as an exclusive OR of the second bit string and the first result, and send the second result to the second device (700, 800); the second device (700, 800) is further configured to: when the first bit string is the same as the received second result, send the opening value to the first device (600, 800) and generate a session key used to communicate with the first device (600, 800), wherein that the first bit string is the same as the second result indicates that the second device (700, 800) successfully authenticates the first device (600, 800); and the first device (600, 800) is further configured to: authenticate the second device (700, 800) based on the received opening value and commitment value, to obtain an authentication result (S") wherein the authentication result is used to indicate that the first device (600, 800) successfully authenticates the second device (700, 800), and to generate a session key used to communicate with the second device (700, 800). the first device (600, 800) is configured to: generate a private-public key pair by using a key generation algorithm, and send a public key in the private-public key pair to the second device (700, 800); the second device (700, 800) is configured to: select an original key (k = K∥K') based on the received public key (pk) by using an encapsulation algorithm, obtain a ciphertext based on the public key and the original key by using the encapsulation algorithm, obtain a commitment value and an opening value (t) based on a first bit string and a random number (r) by using a commitment algorithm, and send the ciphertext and the commitment value to the first device (600, 800), wherein the first bit string is a random bit string; and determine a second bit string based on some bits in the original key, and calculate a first result as an exclusive OR of the first bit string and the second bit string; the first device (600, 800) is further configured to: obtain the original key based on a private key in the private-public key pair and the received ciphertext by using a decapsulation algorithm, determine the second bit string based on the some bits in the original key, calculate a second result as an exclusive OR of the second bit string and the first result, and send the second result to the second device (700, 800); the second device (700, 800) is further configured to: when the first bit string is the same as the received second result, send the opening value to the first device (600, 800) and generate a session key used to communicate with the first device (600, 800), wherein that the first bit string is the same as the second result indicates that the second device (700, 800) successfully authenticates the first device (600, 800); and the first device (600, 800) is further configured to: authenticate the second device (700, 800) based on the received opening value and commitment value, to obtain an authentication result (S") wherein the authentication result is used to indicate that the first device (600, 800) successfully authenticates the second device (700, 800), and to generate a session key used to communicate with the second device (700, 800).