I have wondered about this also.
We could determine whether the private key is odd or even from the public key point only if:
There exists a definition of an "even point" and an "odd point" such that for (X, Y)' = (X, Y) + G
(X, Y)' is odd iff (X, Y) is even and (X, Y)' is even iff (X, Y) is odd
So there would have to be a property of the points on the curve (such as the sign of Y for example) that toggles with each new addition of the point G.
If such a property could be found then it would be possible to determine one bit of the private key from the public key.
Assume for example the sign of Y behaved this way then the private key would be odd if the sign of Y was negative and the private key would be even if the sign of Y was positive.
If you can find such property i can figure out the private key from the public key not only one bit , and because of that i am sure it's too hard to figure it out but not impossible. We could determine whether the private key is odd or even from the public key point only if:
There exists a definition of an "even point" and an "odd point" such that for (X, Y)' = (X, Y) + G
(X, Y)' is odd iff (X, Y) is even and (X, Y)' is even iff (X, Y) is odd
So there would have to be a property of the points on the curve (such as the sign of Y for example) that toggles with each new addition of the point G.
If such a property could be found then it would be possible to determine one bit of the private key from the public key.
Assume for example the sign of Y behaved this way then the private key would be odd if the sign of Y was negative and the private key would be even if the sign of Y was positive.
,
