After asking: Are all possible EC private keys valid? I learned that all 32 byte (256 bit) values greater than 0 and less than n are all valid private keys. This means that 99% of all 256 bit values are valid private keys. (This was a revelation to me.)
The public key space is 257 bits, as it includes X and the sign bit of Y.
Is there an exact 1:1 mapping between private and public keys?
Is there a way of telling whether a 257 bit value is a valid public key? (i.e. that a private key maps to it, as slightly more than half of all 257 bit values must not be valid public keys, if there is a 1:1 mapping.)
(I'm using secp256k1.)
Thanks for your answers.
My mental model, for an imaginary curve with n = 5, a 3 bit private key and 4 bit public key now looks like this:
private public
0x0 +-----------> 0x0
0x1 ---+ 0x1
0x2 -----------+ 0x2
0x3 ---------+ | 0x3
0x4 ---+ +-|---> 0x4
0x5 | | 0x5
0x6 | | 0x6
0x7 | | 0x7
| | 0x8
| +---> 0x9
| 0xa
| 0xb
| 0xc
| 0xd
| 0xe
+-----------> 0xf