Pre-2012: Various LWE & RLWE encryption (KEM) schemes with large ciphertext size. Framework of DH-like key exchange construction appeared. No concrete error reconciliation mechanism 2012: Ding et al. invented the first complete LWE & RLWE-based D