When using ECDHE with Curve25519 with openssl:

Server Temp Key: X25519, 253 bits

I thought when we use X25519, it use 256 bit key. Why openssl shows the server temp key as 253 bits?


The order of the base point of Curve25519 is the a 253-bit integer $2^{252}+ 27742317777372353535851937790883648493$. Choosing as private key a random positive integer less than said order is a common choice in cryptosystems based on the difficulty of the Discrete Logarithm in some group. That might be why private keys are said to be 253-bit.

However, per comment: the set of Curve25519 secret keys is defined as those 32-byte bytestrings which, when converted to integer (per little-endian convention on top of the byte level), form a 255-bit integer $n\in2^{254}+8\{0,1,2,3,\dots,2^{251}-1\}$. That bytestring is 256 bits, among which 251 are variable, and 5 are set to predefined values (the 3 low-order bits and 2 high-order bits: these are zero, except the second-highest order bit). Nothing reasonably adds up to 253.

Note: that's not to be confused with the security level, believed to be comparable to 128-bit symmetric cryptography (best attack cost $2^{140}$ bit operations).


  • 2
    $\begingroup$ The definition of secret keys in the Curve25519 paper defines them to be of 255 bits ($n \in 2^{254} + 8\{0,1,2,3,\dots,2^{251}-1\}$). Does openssl just use the standard definitions of private key (integer mod generator's order) or what? $\endgroup$ – Ruggero Sep 4 '18 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.