IND-CCA2 post-quantum key exchange QUIC requires that servers reuse keys so that session resumption works.  That breaks many post-quantum key exchange systems.

I am looking for a post-quantum key exchange algorithm with the following properties:


Fast (Lattice-based)
IND-CCA2
The chosen key depends on randomness from both parties (this is important for many uses of channel binding).
NewHope is a key-exchange protocol based on the Ring-Learning-with-Errors (Ring-LWE) problem. NewHope512-CCA-KEM and NewHope1024-CCA-KEM are IND-CCA-secure key encapsulation mechanisms which target level 1 and level 5, respectively, (matching or exceeding the brute-force security of AES-128 and AES-256, respectively). Google is working on deploying post-quantum key-agreement in TLS by combining NewHope with an existing key-agreement (X25519)as the combination CECPQ1. Please find a GoLang implementation of NewHope in GitHub.