Curve25519 prove of theorem This paper regarding Curve25519 contains a prove for Theorem 2.1 in the appendix.

Theorem 2.1.: Let p be a prime number with $p ≥ 5$. Let $A$ be an integer such
that $A^2 − 4$ is not a square modulo $p$. Define $E$ as the elliptic curve $y^2 = x^3 + Ax^2 + x$ over the field $F_p$. Define $X_0 : E(F_{p^2} )  \to F_{p^2}$ as follows: $X_0(\infty) = 0$;
$X_0(x, y) = x$. Let $n$ be an integer. Let $q$ be an element of $F_p$. Then there exists a unique $s ∈ F_p$ such that $X_0(nQ) = s$ for all $Q \in E(F_{p^2}) $such that $X_0(Q) = q$.

Case 1 and Case 2 of the proof are pretty trivial. But I don't understand one step in Case 3. The point of Case 3 is to lead it back to Case 2. To do so the variable $\delta$ is introduced. I don't understand why  this is possible and what the meaning of $\delta$ is.
What I understand so far: Curve25519 provides a key exchange for cryptograhic applications. Every point $(x,y)$ with $x \in F_p$ should be a point on the elliptic curve over $F_p$. But $\neg\forall x \in F_p : (x,y) \in E(F_p)$ (There is not a point on the elliptic curve for all x). Hence, you need the extension field $F_{p^2}$ so that $\forall x \in F_p : (x,y) \in E(F_{p^2})$ (There is a point on the elliptic curve for all x). Now I think, that this extension field is used in the prove and this might be the reason for the $\delta$. But I don't quite understand how this works.
 A: Go back to the start of Appendix A. Under Squares in the base field, $\delta$ is defined as some non-square element of $\Bbb F_p$ (they define it as the smallest non-square, but this is only for definiteness). In the next paragraph, The extension field, the field $\Bbb F_{p^2}$ is defined in terms of $\delta$.
A: I am trying to give additional structural support for the theorem 2.1 from loc. cit., hoping that the proof may be better digested. Then say some words.
Let $p$ be a fixed prime. Also fix an integer $n$. I will use $d$ instead of $\delta$ for a non-square element in $\Bbb F_p^\times$.
Using $q$ as an element of the field $K:=\Bbb F_{p^2}$ with $p^2$ elements is against my will, please understand that i must use $t$ instead. (And it is so annoying that i cannot use $q$ as i would. Usually, $q$ is used in such situations as a power of the characteristic $p$.) First of all, we need two good notations for the two fields involved. I will use $K$ for the field with $p^2$ elements and $F\cong \Bbb F_p$ for its subfield with $p$ elements. It is important to study these fields first. Note that up to an isomorphism there is only one field of order $p^2$. It can be obtained from $F$ by adjoining an algebraic element, root of a monic irreducible polynomial of degree two over $\Bbb F_p$. For instance $X^2-d\in\Bbb F_p[X]$. Then let $\sqrt d$ be one fixed root of it in $K$. (It exists, because the field $\Bbb F_p[X]/(X^2-d)$ has $p^2$ elements, thus is $\cong K$. Now we have a Frobenius morphism $\Phi:K\to K$. It maps $x\in K$ to $\Phi x:=\Phi(x):= x^p$. Exactly the elements in $F$ are fixed. A typical element in $K$ is of the shape $a+b\sqrt d$, where $a,b\in F$. We have $\Phi a=a$, $\Phi b=b$, $\Phi \sqrt d=-\sqrt d$. (The last value is still a root of $X^2-d$, but it is not $\sqrt d$. So we take the other sign.)

Consider now the curve $E$ defined over $F$ by
$$
E\ :\qquad y^2 = x^3 +Ax^2+x\ .
$$
Here, $A\in F$ is such that the polynomial $x^3+Ax^2+x=x(x^2+Ax+B)$ has only the zero root in $F$. (So the discriminant $A^2-4$ of the other factor is not a square in $F$.)
We consider the (set of the) $K$-rational points of $E$, denoted by $E(K)$. It is a group with the addition defined algebraically. For each $t\in F$, $t\ne 0$, denote by $A(t)$ the set of all points $(t,y)\in E(K)$. Note that if we have one point $Q(t,y)$, then the other point is $-Q$ with coordinates $(t,-y)$.
So $A(t)$ has exactly two points, because
we eliminated from the discussion the "branching" points $(0,0)$ and $\infty$ (of the rational map $(x,y)\to x$) from $E(K)$, this is anyhow not our problem in the OP. (Case 1 is simple. In case $A^2-4$ is a square, there are two further branching points corresponding to the two other roots.) Then using the multiplication by $n$ map on $E$, we have the following diagram.
$\require{AMScd}$
$$
\begin{CD}
E(K) @>n>> E(K)\\
@AAA @AAA\\
A(t) @>>n> n\cdot A(t)
\end{CD}
$$
Then theorem 2.1 from loc. cit. claims roughly that after fixing a $t\ne 0$ in $F$ the set $n\cdot A(t)$ is a set of the same type, i.e. $A(s)$ for a suitable $s$. Well, this is roughly so because $n$ may be the order of the points $\pm Q$ that are the elements of $A(t)$, and in this case $n\cdot A(t)$ consists of one point, the infinity point $O=\infty$. This situation makes no problems, so assume that $n$ is not the order of $\pm Q$. Let us find now the value $s\in F$ and reduce the whole proof to a structural observation. Start with one of the two points, $Q=(t,y)\in E(K)$, in $A(t)$. (The other point is $-Q$.) We may have $y\not \in F$. We build the point $nQ=(\sigma,\eta)$. A priori we know only $\sigma,\eta\in K$. We need $\sigma \in F$. Now we make the following observation.
The Frobenius morphism $\Phi:K\to K$ induces a Frobenius morphism denoted by the same letter $\Phi:E(K)\to E(K)$. It acts on the components of a point. So the point $Q=(t,y)$ is mapped to $\Phi Q=(\Phi t,\Phi y)=(t,\Phi y)\in E(K)$. Because $y$ satisfies the equation over $F$ of degree two $Y^2 = t^3+At^2+t$ and the other root is $-y$, and because $\Phi y$ satisfies the same equation, we have $\Phi y=\pm y$. The case with the plus sign is Case 2 in the proof, the minus sign leads to Case 3. We consider them together, since we can write:
$$
\Phi Q = \pm Q\ .
$$
This implies
$$
\tag{$*$}
\Phi(nQ)=n\Phi Q=n(\pm Q)=\pm (nQ)\ .
$$
Taking the first component of $\Phi(nQ)=(\Phi\sigma,\Phi\eta)$ and $\pm(nQ)=(\sigma\pm\eta)$ we get $\Phi \sigma=\sigma$. So $\sigma \in F$. We write then $s=\sigma\in F$ and have obtained $nA(t)=A(s)$. (The second point in $A(t)$ is easily examined.)

Some comments on the connection between the two proofs. In case 2 we have $\eta\in F$, so $Q\in E(F)$, so $n Q\in E(F)$, and there is nothing to be shown. Instead of writing $E(F)$ we have in loc. cit. an intersection with the cartesian product $F\times F$. In case 3 we have $\eta\not\in F$, and we can write $\eta=r\sqrt d\in F\cdot\sqrt d$ for some $r\in F$. Then the Frobenius action on $\eta$ is $\eta\to\Phi\eta=-r\sqrt d$, and we have in loc. cit. an intersection with the cartesian product $F\times F\cdot\sqrt d$ used as above.

This is a long answer for a simple algebraic argument, condensed in the relation $(*)$. But most time i had to introduce notations and explain algebraic structures that are not assumed to be known in loc. cit. - where there is also a cautious usage of algebraic geometry language.
