Curve25519 extension field

Question

The paper regarding curve25519 presents a theorem in chapter 2 (specification). The extension field $F_{p^2}$ is used in this theorem. I don't understand why this extension field is needed for the curve25519. This is how far I got:

The theorem implies that for some elliptic curves $E$ exists a unique $s \in F_p$ for every point multiplication $n \cdot Q$ ($s$ is the x-value of the resulting point). Point multiplication can be done using the Montgomery Ladder. Curve25519 has a base point $P = (9,y)$, where $y$ is not used in the Montgomery Ladder. Because $P$ is a point on the Curve, the point multiplication $P' = n \cdot P$ has also to be a point on the curve. Now one can multiply another scalar with $P'$ which again results to point on the elliptic curve. In this context, only $F_p$ should be needed for the curve25519.

Hence, I think that the extension field is only used, if you consider the point multiplication for all point $Q = (q,r)$ for every $q \in F_p$. That means $Q \notin E(F_p)$ but $Q \in E(F_{p^2})$. I don't understand why this case in considered, when it is never used.

Answer 1

I don't really know so I'll tell you my best guess: One of the design goals was "free point validation". To do this, we want to make sure that no matter what $x$-value in $F_p$ we're sent, it is a valid point on the curve.

If $x\in F_p$, then to make an elliptic curve point we need $y$ such that $y^2=x^3+488862x^2+x$. But we have no reason to expect that $x^3+488862x^2+x$ will be a quadratic residue, so in general we will need to define $y$ over $F_{p^2}$. Thus, if I send you any value $x$ in $F_p$ and tell you it's a point on the curve, you know that there is some $y\in F_{p^2}$ such that $(x,y)\in E(F_{p^2})$, but you have no guarantee that $y\in F_p$.

The key exchange uses $x$-only arithmetic, so the key exchange will never need to use the extension field in any computations. Theorem 2.1 tells us that all multiples of a point with an $x$-value in $F_p$ will also have $x$-values in $F_p$, which proves correctness of the $x$-only arithmetic, more or less. So I think the case of $Q\in E(F_{p^2})$ but $Q\notin E(F_p)$ is used, but only via an implicitly-defined $y$-value.