. Isomorphic curves have the same j-invariant; over an algebraically closed field, two curves with the same j-invariant are isomorphic. The supersingular isogeny Diffie-Hellman protocol (SIDH) works with the graph whose vertices are (isomorphism classes of) supersingular elliptic curves and whose edges are isogenies between those curves. An isogeny between elliptic curves and is a rational map which is also a group homomorphism. If separable, is determined by its kernel up to an isomorphism of target curve . The setup for SIDH is a prime of the form , for different (small) primes and , (large) exponents and , and small cofactor , together with a supersingular elliptic curve defined over . Such a curve has two large torsion subgroups, and , which are assigned to Alice and Bob, respectively, as indicated by the subscripts. Each party starts the protocol by selecting a (secret) random cyclic subgroup of their respective torsion subgroup and computing the corresponding (secret) isogeny. They then publish, or otherwise provide the other party with, the equation for the target curve of their isogeny along with information about the image of the other party's torsion subgroup under that isogeny. This allows them both to privately compute new isogenies from whose kernels are jointly generated by the two secret cyclic subgroups. Since the kernels of these two new isogenies agree, their target curves are isomorphic. The common j-invariant of these target curves may then be taken as the required shared secret. Since the security of the scheme depends on the smaller torsion subgroup, it is recommended to choose . An excellent reference for this subject is De Feo's article "Mathematics of Isogeny Based Cryptography." Security The most straightforward way to attack SIDH is to solve the problem of finding an isogeny between two supersingular elliptic curves with the same number of points. At the time of the original publication due to De Feo, Jao and Plût, the best attack known against SIDH was based on solving the related claw finding problem, which led to a complexity of O(p1/4) for classical computers and O(p1/6) for quantum computers. This suggested that SIDH with a 768-bit prime (p) would have a 128-bit security level. A 2014 study of the isogeny problem by Delfs and Galbraith confirmed the O(p1/4) security analysis for classical computers. The classical security O(p1/4) remained unaffected by related cryptanalytic work of Biasse, Jao and Sankar as well as