Hybrid Sequence:
The starting point is $\lib{ke-real}$, which outputs the protocol transcript $(\mat G, \vec x, \vec y, R)$ and corresponding output key $\alpha$.
We can apply the LWE assumption to replace $\vec y$ with a uniformly sampled vector. The standard three-hop maneuver is not shown.
Both $\vec x$ and $K$ are computed in a similar way: a multiplication (on the left) by $\vec a^\top$, followed by an addition of a noise term. We can therefore write both $\vec x$ and $K$ in terms of a single matrix expression, by appending $\vec y$ to the LWE matrix $\mat G$ and $e$ to the noise vector $\vec e_1$.
Now $(\vec x, K)$ are computed as (the transpose of) an LWE sample, using a uniformly sampled $(n+1) \times n$ LWE matrix $[\mat G \mid \vec y]$. We can therefore apply the LWE assumption to replace these values with uniform ones.
Now $K$ is distributed uniformly and used only to compute $R$. Thus, $R$ is a ciphertext in the OTP variant that uses addition mod $\qmod$, so it is distributed uniformly. The result of this change is $\lib{ke-rand}$, which completes the proof.
$\lib{ke-real}$
$\mat G \gets (\Z_\qmod)^{n \times n}$
$\vec a \gets \mathcal E^n$
$\vec e_1^\top \gets \mathcal E^n$
$\vec x^\top := \vec a^\top \mat G + \vec e_1^\top$
$\vec b \gets \mathcal E^n$
$\vec e_2 \gets \mathcal E^n$
$\vec y := \mat G \vec b + \vec e_2$
$e \gets \mathcal E$
$K := \vec a^\top \vec y + e$
$\alpha \gets \bits$
$R $
${}:= K + \alpha\lfloor \qmod/2 \rfloor \pct \qmod$
${}\gets \Z_\qmod$
ke.eavesdrop( ):
return $(\mat G, \vec x, \vec y, R, \alpha)$