How to show that any 2-round key-exchange protocol satisfying a given definition can be converted into a public-key encryption scheme? How to show that any 2-round key-exchange protocol satisfying a given definition can be converted into a public-key encryption scheme that is CPA-secure?

The given definition is as followed:


Actually this is an exercise of the book "Introduction to modern cryptography", I can figure out how to prove it.

Can someone help me? Thanks a lot!
My reputation won't let me post this as a comment, but I believe you could simply use the key exchange as a one time pad.

Alice and Bob could use the key-exchange as normal. Alice initiates the key-exchange and sends the first round. Bob sends the second round. They now both have enough information to generate a shared key of length $k$ bits, which is CPA secure. Bob then sends a message of length $l \leq k$ XORed with the shared key (obviously only sending $l$ bits). Alice can decrypt this message, simply by XORing with the shared key.

Note that the entire key exchange needs to be repeated for each block of $k$ message bits. This repetition must be secure.