X25519 - why openssl shows 253 bits?

When using ECDHE with Curve25519 with openssl:

Server Temp Key: X25519, 253 bits

I thought when we use X25519, it use 256 bit key. Why openssl shows the server temp key as 253 bits?

1 Answer

The order of the base point of Curve25519 is the a 253-bit integer $2^{252}+ 27742317777372353535851937790883648493$. Choosing as private key a random positive integer less than said order is a common choice in cryptosystems based on the difficulty of the Discrete Logarithm in some group. That might be why private keys are said to be 253-bit.

However, per comment: the set of Curve25519 secret keys is defined as those 32-byte bytestrings which, when converted to integer (per little-endian convention on top of the byte level), form a 255-bit integer $n\in2^{254}+8\{0,1,2,3,\dots,2^{251}-1\}$. That bytestring is 256 bits, among which 251 are variable, and 5 are set to predefined values (the 3 low-order bits and 2 high-order bits: these are zero, except the second-highest order bit). Nothing reasonably adds up to 253.

Note: that's not to be confused with the security level, believed to be comparable to 128-bit symmetric cryptography (best attack cost $2^{140}$ bit operations).

References:

• The definition of secret keys in the Curve25519 paper defines them to be of 255 bits ($n \in 2^{254} + 8\{0,1,2,3,\dots,2^{251}-1\}$). Does openssl just use the standard definitions of private key (integer mod generator's order) or what? – Ruggero Sep 4 '18 at 10:02