Curve25519 function, scalar multiplikation This is the main paper for Curve25519. In section 2: Specification there is a important theorem. In this theorem Bernstein defines the function $X_0 : E(F_{p^2}) \rightarrow F_{p^2}$. 

First Question: Curve25519 is a Montgomery curve and uses the projektive arithmetic, which only needs the x-coordinate. The defined functions makes a scalarmultiplication and then takes the x-coordinate from the result. Therefore why isn't it defined as $X_0 : E(F_{p}) \rightarrow F_{p}$? ( or $X_0 : F_{p} \rightarrow F_{p}$ )

Second Question: When making a scalar multiplication on a point of a elliptic curve, the result is always a point. So why is it defined as $X_0 : E(F_{p^2}) \rightarrow F_{p^2}$ and not as $X_0 : E(F_{p^2}) \rightarrow E(F_{p^2})$? One can say, that $E(F_{p^2})$ is not the x-value of a point. In this case, why is it not defined as $X_0 : E(F_{p^2}) \rightarrow F_{p}$?
I got the answer now! Curve25519 does not have key validation. Usually you have a point $P =(x,y)$ on a elliptic curve $E$ over $F_p$. But there is not a point $P$ on the elliptic curve for every value in $F_p$. If you make a key exchange with such a system, you will get a point, or a x-Value (using Montgomery x-only computation). Now you have to test, wether the given point is on the elliptic curve or not, because you can't calculate with a point, thats not on the curve.
Now as i said Curve25519 does not have key validation, because it takes time. But the theorem (in which $X_0$ is defined, too) in the paper about Curve25519 that says, that there is a Point for every x-Value over $F_p$. So you don't need key validation!
The bottom line of is, that you only need the extension field $F_{p^2}$, because you don't want key validation.