Am implementing x25519 (in 64 bit and 512 bit assembly) following the specifications in RFC 7748 (and its errata list !).
Need two clarifications please.
The private key is randomly generated 32 byte string with MSB set to 0 and MSB-1 set to 1, and, last 3 bits set to zero. Now, once a random 256 key has been generated, it is made compliant to these specified requirements, and the corresponding public key has been computed. The clarification being sought is : does the private key remain this 32 byte string after the MSB/MSB-1 is set ? Does this imply that the actual count of universe of random private keys is restricted to 2^251 (256 - MSB - [MSB-1] - 3 LSB - all these bits are fixed) ? If an external user were to specify a key that is not compliant with this requirement, and the software modifies it to become complaint, does the external user specified private key needs to be updated with this post compliant string ?
Most implementers (e.g. Michael Dull (apologies for not being able to type the umlaut in the surname) et. al. in paper "High speed Curve25519...") have mentioned that the last inversion step (Z^(p-2)) requires 254 squaring steps and 11 multiplications. I understand the 254 squaring steps, but am not sure what algorithm is used to restrict the count of multiplications to such a small number. If this is not a state secret, can I be directed towards the actual algorithm that generates the inversion mod p-2 with (just) 11 multiplications ?
Thanks for your attention and time.