the noiseless variant that an attacker could forge shorter
A key-agreement construction can fail in two unrelated ways. It can fail to agree, or it can be forgeable. We were exploring two tracks at once: a noiseless variant, where both parties derive exactly the same value with no rounding and no…