In a recent mail on the IETF CFRG mailing list it was claimed that:
The (currently missing) security considerations (or somewhere) should describe why Curve25519 is ok when used in contexts where we'd otherwise ask for 128 bit strength, (basically because it's close enough), and also why the 224 bit level is considered a good choice. There was a lot of debate on the list about that, and I've seen the issue come up elsewhere so this text will avoid re-litigating that and should be worthwhile even if it takes a little time to agree.
I read this such that Curve25519 only provides security on the 224-bit level i.e. 112 bit security.
But when I look up Curve25519 on Wikipedia I get to see in the very first line that
Curve25519 is an elliptic curve offering 128 bits of security
Wikipedia itself references to Bernsteins original paper "Curve25519: new Diffie-Hellman speed records" which indeed confirms Wikipedia as follows:
Every known attack is more expensive than performing a brute-force search on a typical 128-bit secret key cipher.
So my question is:
Does Curve25519 indeed provide significantly less security than 128-bit?