Can multiple public keys lead to the same shared secret in X25519?

Question

I have no mathematical knowledge about this, but I just read in RFC 7748 the following:

Designers using these curves should be aware that for each public key, there are several publicly computable public keys that are equivalent to it, i.e., they produce the same shared secrets. Thus using a public key as an identifier and knowledge of a shared secret as proof of ownership (without including the public keys in the key derivation) might lead to subtle vulnerabilities

Does that mean that multiple Curve25519 public keys can produce the same shared key produced by X25519? I just don't understand.

Does this mean that key servers (let's say that such key servers even verify the ownership of these public key using sending an encrypted challenge to the claimant) using Curve25519 are not a good idea?

Answer 1

There are two independent sources of equivalent public keys for the X25519 function.

---

The first is rather simple: A public key is an integer u between $0$ and $2^{255}-1$ that represents an element of the finite field $\mathrm{GF}(2^{255}-19)$. Hence, for all $i\in\{0,\dots,18\}$, the integer $2^{255}-19+i$ represents the same field element as the integer $i$.

---

The second source of equivalence is a bit more specific. In a nutshell, the X25519(k,u) function is defined as follows:

• Clamp the secret key k, forcing bits $\{0,1,2,255\}$ to zero and bit $254$ to one.
  In particular, note that this means the clamped scalar $k'$ is a multiple of $8$.
• Compute the scalar product $[k']P$, where $P$ is a Curve25519 point with $x$‑coordinate u.
• Return the $x$-coordinate of $[k']$P.

Now Curve25519 has cofactor $8$, hence there exist nonzero points $Q$ of order dividing $8$. For any such point, the public key $P+Q$ is equivalent to the public key $P$: Since $k'$ is a multiple of $8$, we have $$ [k']Q = [k'/8][8]Q = [k'/8]\infty = \infty $$ and therefore (using the distributive law) $$ [k'](P+Q) = [k']P + [k']Q = [k']P+\infty = [k']P \text. $$

For a concrete example, the two public keys

629fb7d4a50e0339edfdfae1464fedb848dd35f25c5fecd3d3f5af61654a691d
b53677c430779b050cd6db7e1f4ca6735e07b30a61711f45a88e710790af772a

will, for every secret key, give identical shared secrets using X25519.