Can multiple public keys lead to the same shared secret in X25519?
There are two independent sources of equivalent public keys for the X25519 function.



The first is rather simple: A public key is an integer u between $0$ and $2^{255}-1$ that represents an element of the finite field $\mathrm{GF}(2^{255}-19)$. Hence, for all $i\in\{0,\dots,18\}$, the integer $2^{255}-19+i$ represents the same field element as the integer $i$.



The second source of equivalence is a bit more specific.
In a nutshell, the X25519(k,u) function is defined as follows:


Clamp the secret key k, forcing bits $\{0,1,2,255\}$ to zero and bit $254$ to one.

In particular, note that this means the clamped scalar $k'$ is a multiple of $8$.
Compute the scalar product $[k']P$, where $P$ is a Curve25519 point with $x$‑coordinate u.
Return the $x$-coordinate of $[k']$P.


Now Curve25519 has cofactor $8$, hence there exist nonzero points $Q$ of order dividing $8$. For any such point, the public key $P+Q$ is equivalent to the public key $P$: Since $k'$ is a multiple of $8$, we have
$$ [k']Q = [k'/8][8]Q = [k'/8]\infty = \infty $$
and therefore (using the distributive law)
$$ [k'](P+Q) = [k']P + [k']Q = [k']P+\infty = [k']P \text. $$

For a concrete example, the two public keys

629fb7d4a50e0339edfdfae1464fedb848dd35f25c5fecd3d3f5af61654a691d
b53677c430779b050cd6db7e1f4ca6735e07b30a61711f45a88e710790af772a


will, for every secret key, give identical shared secrets using X25519.