ECDH, x25519 and limitations for securing client-certificates on the server

Question

g'day Crypto.SE

I'm working on a practical application of sharing a static key to better-identify a user, between the recipient (server) and the initiator (client ie. user's machine).

My core question is:

For x25519, can multiple PK's resolve to a single SK, or is there ever only one unique PK-SK pair?

I'm wondering whether it's rational to think of x25519 public-keys as holding an "almost" equal share in securing information? By "almost" equal, I mean that I can always derive the PK from the SK.

If I didn't have the PK or the SK, would I be able to produce a message that matched an SK at better probability than a brute-force guess across (half?) the x25519 key-space?

My original q, slightly re-worded and still bl**dy confusing, sorry!

Without either the PK or SK for an x25519 key-pair, is there a greater probability that I can encrypt a message for an unknown SK, than I would otherwise have being able to determine the SK from the PK (if I had the PK).

Specifics for my application handshake is here:

Handshake protocol that uses x25519 and Argon2 to secure user secret-keys on the server

Answer 1

For x25519, can multiple PK's resolve to a single SK, or is there ever only one unique PK-SK pair?

If I wasn't mistaken, there can be atmost 2 PK corresponding to 1 SK in x25519, depending on whether the implicit y-coordinate is internally positive or negative. As for ECDH on the other hand, the mapping is 1:1.

I'm wondering whether it's rational to think of x25519 public-keys as holding an "almost" equal share in securing information? By "almost" equal, I mean that I can always derive the PK from the SK.

From the way you explain your question, I assume you mean whether the PK and SK are equally essential: yes, the only thing to be noted is that their role is different.

(In the previous form of the question, answerers may confuse your question as asking whether the PK of both parties are equally important).

If I didn't have the PK or the SK, would I be able to produce a message that matched an SK at better probability than a brute-force guess across (half?) the x25519 key-space?

Do you mean forging a ciphertext that can be decrypted with an SK without knowing its corresponding PK? This type of attack is known as existential forgery - a term usually applied to digital signatures and message authentication codes.

In existential forgery, the attacker produces a message that can be correctly verified (in your case, successfully decrypted) with a key that's possibly unknown. See What do the signature security abbreviations like EUF-CMA mean? and Easy explanation of "IND-" security notions? for further explanation.

.. is there a greater probability that I can encrypt a message for an unknown SK, than I would otherwise have being able to determine the SK from the PK (if I had the PK).

For elliptic curve key exchange and encryptions, this isn't likely, as the key-recovery complexity and forgery complexity are essentially equal.