In SIDH both parties agree on the key in following way:

1. Alice calculates a kernel $R = mPB + nQB$
2. Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$
3. She uses $\phi_a$ to start hers random walk and ends up with trio $(E_a, \phi_a(PB),\phi_a(PB))$
4. Now she sends this trio to Bob (I know, she actually sends 3 points)
5. Bob does the same, let say his secret isogeny is $\phi_b$. Upon receipt of corresponding trio from Bob $(E_b, \phi_b(PA), \phi_b(QA))$ Alice uses $m, n$ to compute new kernel $R' = m*\phi_b(PA) + n*\phi_b(QA)$ and new isogeny
6. Then she starts from $E_b$ and does the random walk again ending on $E_{ab}$
7. Bob proceeds mutatis mutandis and ends up on a probably different curve $E_{ba}$, but surely in same isogeny class as Alice. Thanks to j-invariant then can agree on a shared secret $j(E_{ab}) == j(E_{ba})$

Now, I've to say point 6. and 7. are a bit black magic to me. I understand that we have this equality here:

$R' =m*\phi_b(PA) + n*\phi_b(QA) = \phi_b(m*PA + n*QA)$

But still, why exactly they will end up in the same isogeny class? What is a mathematical base, for those two isogenies to converge to the same class. I'm wondering how would a proof look like for this.

In SIDH both parties agree on the key in following way:

1. Alice calculates a kernel $R = mPB + nQB$
2. Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$
3. She uses $\phi_a$ to start hers random walk and ends up with trio $(E_a, \phi_a(PB),\phi_a(PB))$
4. Now she sends this trio to Bob (I know, she actually sends 3 points)
5. Bob does the same, let say his secret isogeny is $\phi_b$. Upon receipt of corresponding trio from Bob $(E_b, \phi_b(PA), \phi_b(QA))$ Alice uses $m, n$ to compute new kernel $R' = m*\phi_b(PA) + n*\phi_b(QA)$ and new isogeny
6. Then she starts from $E_b$ and does the random walk again ending on $E_{ab}$
7. Bob proceeds mutatis mutandis and ends up on a probably different curve $E_{ba}$, but surely in same isomorphism class as Alice. Thanks to j-invariant then can agree on a shared secret $j(E_{ab}) == j(E_{ba})$

Now, I've to say point 6. and 7. are a bit black magic to me. I understand that we have this equality here:

$R' =m*\phi_b(PA) + n*\phi_b(QA) = \phi_b(m*PA + n*QA)$

But still, why exactly they will end up in the same isomorphism class? What is a mathematical base, for those two isogenies to converge to the same class. I'm wondering how would a proof look like for this.

In SIDH both parties agree on the key in following way:

1. Alice calculates a kernel R = m*PB + n*QB
2. Thanks to Velu formulas (and further improvements), she can now compute isogeny p
3. She uses p to start hers random walk and ends up with trio (Ea, phiPB, phiQB)
4. Now she sends this trio to Bob (I know, she actually sends 3 points)
5. Upon receipt of corresponding trio from Bob (Eb, phiPA, phiQA) she uses m, n to compute new kernel R' = m *phiPA + n*phiQA and new isogeny
6. Then she starts from Eb and does the random walk again ending on Eab
7. Bob proceeds mutatis mutandis and ends up on a probably different curve Eba, but surely in same isogeny class as Alice. Thanks to j-invariant then can agree on a shared secret j(Eab) == j(Eba)

Now, I've to say point 6. and 7. are a bit black magic to me. What I don't understand is - why exactly they will end up in the same isogeny class? What is a mathematical base, for those two isogenies to converge to the same class. I'm wondering how would a proof look like for this.

In SIDH both parties agree on the key in following way:

1. Alice calculates a kernel $R = mPB + nQB$
2. Thanks to Velu formulas (and further improvements), she can now compute isogeny $\phi_a$
3. She uses $\phi_a$ to start hers random walk and ends up with trio $(E_a, \phi_a(PB),\phi_a(PB))$
4. Now she sends this trio to Bob (I know, she actually sends 3 points)
5. Bob does the same, let say his secret isogeny is $\phi_b$. Upon receipt of corresponding trio from Bob $(E_b, \phi_b(PA), \phi_b(QA))$ Alice uses $m, n$ to compute new kernel $R' = m*\phi_b(PA) + n*\phi_b(QA)$ and new isogeny
6. Then she starts from $E_b$ and does the random walk again ending on $E_{ab}$
7. Bob proceeds mutatis mutandis and ends up on a probably different curve $E_{ba}$, but surely in same isogeny class as Alice. Thanks to j-invariant then can agree on a shared secret $j(E_{ab}) == j(E_{ba})$

Now, I've to say point 6. and 7. are a bit black magic to me. I understand that we have this equality here:

$R' =m*\phi_b(PA) + n*\phi_b(QA) = \phi_b(m*PA + n*QA)$

But still, why exactly they will end up in the same isogeny class? What is a mathematical base, for those two isogenies to converge to the same class. I'm wondering how would a proof look like for this.