X25519 - why openssl shows 253 bits? When using ECDHE with Curve25519 with openssl:



Server Temp Key: X25519, 253 bits

I thought when we use X25519, it use 256 bit key.  Why openssl shows the server temp key as 253 bits?
The order of the base point of Curve25519 is the a 253-bit integer $2^{252}+ 27742317777372353535851937790883648493$. Choosing as private key a random positive integer less than said order is a common choice in cryptosystems based on the difficulty of the Discrete Logarithm in some group. That might be why private keys are said to be 253-bit.

However, per comment: the set of Curve25519 secret keys is defined as those 32-byte bytestrings which, when converted to integer (per little-endian convention on top of the byte level), form a 255-bit integer $n\in2^{254}+8\{0,1,2,3,\dots,2^{251}-1\}$. That bytestring is 256 bits, among which 251 are variable, and 5 are set to predefined values (the 3 low-order bits and 2 high-order bits: these are zero, except the second-highest order bit). Nothing reasonably adds up to 253.

Note: that's not to be confused with the security level, believed to be comparable to 128-bit symmetric cryptography (best attack cost $2^{140}$ bit operations).

References:


Daniel J. Bernstein, Curve25519: new Diffie-Hellman speed record, in proceedings of PKC 2006
Daniel J. Bernstein, Niels Duif, Tanja Lange, Peter Schwabe, Bo-Yin Yang: High-speed high-security signatures, in proceedings of CHES 2011 and JoCE 2012.