The Supersingular Isogeny Diffie-Hellman (SIDH) protocol is a key exchange mechanism based on the hardness of computing isogenies between supersingular elliptic curves. Unlike classical methods, which rely on problems like integer factorization or discrete logarithms, SIDH leverages the mathematical structure of elliptic curves and isogenies to provide security even against quantum computers. Its key idea is to use torsion points to generate isogenies and compute shared secrets between two parties. The protocol’s design enables compact key sizes and efficient performance, making it an appealing choice for post-quantum cryptography.

An elliptic curve over a finite field \( \mathbb{F}_p \) (or an extension field \( \mathbb{F}_{p^2} \)) is defined by an equation of the form: \[ E: y^2 = x^3 + ax + b \] where \( a, b \in \mathbb{F}_p \), and the discriminant \( \Delta = -16(4a^3 + 27b^2) \) is non-zero to ensure the curve is non-singular. Every elliptic curve has an associated j-invariant, a value that classifies the curve up to isomorphism over an algebraically closed field. It is defined as: \[ j(E) = 1728 \cdot \frac{4a^3}{4a^3 + 27b^2} \] In SIDH, the j-invariant plays a crucial role in computing the shared secret since the j-invariant of the resulting isogeny image curve is used as the final output of the protocol.

Elliptic curves are algebraic varieties, meaning they are defined as the solution sets of polynomial equations. As such, the points on an elliptic curve can be represented in different coordinate systems. The most common are affine coordinates, where each point is given by \( (x, y) \), and projective coordinates, where a point is expressed as \( (X : Y : Z) \), satisfying the homogeneous equation: \[ Y^2 Z = X^3 + aXZ^2 + bZ^3 \] Affine coordinates are suitable for simple computations, while projective coordinates are preferred in many cryptographic applications to avoid costly inversion operations in finite fields.

In general, projective space \( \mathbb{P}^n \) is the set of all lines through the origin in \( \mathbb{F}^{n+1} \), and it allows for a uniform treatment of points at infinity. Each point in projective space is represented by a tuple \( (X_0 : X_1 : \cdots : X_n) \), not all zero, with equivalence defined by scalar multiplication: \( (X_0 : \cdots : X_n) \sim (\lambda X_0 : \cdots : \lambda X_n) \) for any nonzero \( \lambda \in \mathbb{F} \).

A projective curve is an algebraic curve defined in projective space. For elliptic curves, the projective model ensures that the curve remains well-defined even at infinity, which is crucial for handling operations like point addition uniformly.

This homogeneous form ensures the curve includes the point at infinity \( (0 : 1 : 0) \), which serves as the identity element in the elliptic curve group law.

To perform isogeny-based key exchange, torsion points of elliptic curves are essential. In SIDH, two distinct primes (typically 2 and 3) are used, and torsion subgroups of corresponding orders are exploited. To compute these torsion points, the Weil pairing is often used. The general formula for the Weil pairing between two \( m \)-torsion points \( P \) and \( Q \) on an elliptic curve is: \[ e_m(P, Q) \in \mu_m \] This bilinear and alternating pairing helps verify linear independence of torsion points, a property vital for SIDH to ensure the construction of correct and non-degenerate isogenies.

The actual mapping of isogenies between curves is computed using Vélu’s formula, which provides a way to construct an isogeny from a known finite subgroup \( G \subset E \). The general form of Vélu's formula gives the isogeny \( \phi: E \rightarrow E' = E/G \), and the mapping of a point \( P \in E \) is expressed as: \[ \phi(P) = P + \sum_{Q \in G \setminus \{0\}} (Q - [1]P) \] This ensures that the structure of the subgroup \( G \) is correctly transferred onto the codomain curve \( E' \), forming the basis for secure communication.

In typical implementations of isogenies, especially those arising from Vélu’s formula, the y-coordinate of a mapped point is often computed as a constant multiple of the derivative of the x-coordinate of the isogeny map. Mathematically, this is expressed as: \[ \phi(P) = (f(x),y \cdot f(x)') \] Additionally, understanding the structure of supersingular elliptic curves, their rich endomorphism rings, and the difference between ordinary and supersingular curves are all foundational to working with SIDH. Supersingular curves are chosen because their endomorphism rings are non-commutative, increasing the difficulty of reverse-engineering the isogeny path — a core security feature of the protocol.

Together, these mathematical concepts build the theoretical foundation upon which the SIDH protocol is constructed.