In SIDH both parties agree on the key in following way: 1. Alice calculates a kernel `` R = m*PB + n*QB`` 2. Thanks to Velu formulas (and further improvements), she can now compute isogeny ``p`` 3. She uses ``p`` to start hers random walk and ends up with trio ``(Ea, phiPB, phiQB)`` 4. Now she sends this trio to Bob (I know, she actually sends 3 points) 5. Upon receipt of corresponding trio from Bob ``(Eb, phiPA, phiQA)`` she uses ``m, n`` to compute new kernel ``R' = m *phiPA + n*phiQA`` and new isogeny 6. Then she starts from ``Eb`` and does the random walk again ending on ``Eab`` 7. Bob proceeds *mutatis mutandis* and ends up on a probably different curve ``Eba``, but surely in same isogeny class as Alice. Thanks to j-invariant then can agree on a shared secret ``j(Eab) == j(Eba)`` Now, I've to say point 6. and 7. are a bit black magic to me. What I don't understand is - why exactly they will end up in the same isogeny class? What is a mathematical base, for those two isogenies to converge to the same class. I'm wondering how would a proof look like for this.